The people are the problem, and the misperception that they don't need to own these requirements for the business and are just in a hurry to check a box (on all

The people are the problem, and the misperception that they don't need to own these requirements for the business and are just in a hurry to check a box (on all sides). Agreed. I think the framing of compliance in most companies helps reinforce this mindset. It comes from a place of compliance as "avoiding downside in the form of fines or gov't censure", not compliance as "a set of standards we abide by, that provides upsides to all of our customers by virtue of our following them".