Put a statutory value on info, and a huge breach bankrupts you, so you seek insurance. The insurers want money, not risk, so they due the living hell out of you

Put a statutory value on info, and a huge breach bankrupts you, so you seek insurance. The insurers want money, not risk, so they due the living hell out of your diligence. As you said, if it’s done right it’s self-correcting. BUT... do it wrong and business will adapt in malignant ways, like folding and restarting, or spinning off the liability.