I have heard about OKRs but feel I don't really grok them. How can the whole org have common goals. Consider an IT dept. In my company, they ONLY focus on secur

I have heard about OKRs but feel I don't really grok them. How can the whole org have common goals. Consider an IT dept. In my company, they ONLY focus on security .. which means they spend all their time locking things down and making life intolerable for end users. From my perspective, security should be one metric but others would be subjective (user's perspective of IT systems and services) and objective (avg number of tickets, turn-around time, etc.). Even in a chip company, how does a sub-org like IT implement OKRs?