"...and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure..."

"...and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure..." ...but won't see any particular repercussions until they get hit with a few million dollars ransom and some short-term bad PR.