Leadership
Fragmentation isn't a failure of any one team. It's what happens by default.
Every team is doing something reasonable
Each group built a security process that suits its own device, and none of them is doing anything wrong. The gap only appears when you try to add five sound answers to five different questions together and find they don't compose into a program.
One diagnostic, not one process
The same twenty-five questions go to every team and take about ten minutes each, which is what makes a portfolio-wide baseline achievable without changing how any group builds its device. You standardise the measurement, not the engineering.
The gaps that only show up in aggregate
One team weak on postmarket monitoring is a task for that team. Every team weak on it is a practice your organisation never established, and that is a different problem with a different owner. A consolidated view is the only place the second kind becomes visible.