Deciding what to standardize across global capability centers versus what to customize shapes security, compliance and scale.