> That said, there are fair number of common-sense low or zero cost safeguards any technical employees could implement to help mitigate threats. The cost isn't

> That said, there are fair number of common-sense low or zero cost safeguards any technical employees could implement to help mitigate threats. The cost isn't in the safeguards. The cost is in the governance structures (i.e. time spent by mid-level managers) that ensure the safeguards are followed and applied consistently across the organization. Encrypting database fields is basically free. Making sure all database fields that should be encrypted are is an expensive process.