Of course not, because that's the company's core competency. A better analogy is running a construction company without quarterly software security audits. Beca

Of course not, because that's the company's core competency. A better analogy is running a construction company without quarterly software security audits. Because if that list of clients along with contact info gets leaked, that could be a GDPR violation.