Don't take ISO. Let the market sort it out, after the governement provides the right incentives, and maybe provides some minimal baseline. For example, the go

Don't take ISO. Let the market sort it out, after the governement provides the right incentives, and maybe provides some minimal baseline. For example, the gov gives huge fines, and pierces the corporate veil. Then insurers insure the risks for a data breach. They calculate the expensive premium, and lower it if you do what the consider the right thing, e.g. some ISO guidelines. Now incentives are aligned: Corporations secure their infra to avoid expensive premiums. Insurers give correct security guidance. If they overbear, they lose customers. If they are too lax, they pay huge insurance claims. The governement's job is to make sure nobody is asleep at thehelm. After a while, make the insurance mandatory. Basically, it's what works for fire insurance.