Compliance is performative until it isn't. If you've ever been party to a breach, the role of compliance and an audit trail to the security narrative becomes _v

Compliance is performative until it isn't. If you've ever been party to a breach, the role of compliance and an audit trail to the security narrative becomes _very_ important. Consider: 1. We had a breach. A factor in this was insufficient oversight on a process that granted privileged access to customer data. We fixed the problem, promise that your data is safe, and don't believe this will happen again. 2. We had a breach. A factor in this was due to a gap in an existing control around customer data that had a problem we had not anticipated. These were the people involved. This is exactly how this problem occurred. This is the data that was exposed. This is documentation of our response to this incident. This is our existing policy around how we handle data and how we respond to breaches. Customers, partners, regulators, and law enforcement respond a lot better when you can demonstrate good intent and at least imply that you have some kind of process. Of the two scenarios I outlined, the latter provides those assurances. Compliance isn't the only way to do this, but it's often the easiest.