3 ms·

I don't think it is quite that bad. It is certainly less than going full ISO 27001, and less than a major breach.