KR3.1: Select and scope 2 high-impact strategic pilots (e.g., IAM, Control Rationalization, or Secure Cloud)
KR3.2: Kick off pilots with KPIs, executive sponsor, and SPI 360 alignment by Day 75
KR3.3: Report early progress to ELT or risk committee with SPI-based evidence by Day 90