The reality is that most companies can't afford an IT budget it would require to implement, and then force adherence to, a standard set of best practices for mu

The reality is that most companies can't afford an IT budget it would require to implement, and then force adherence to, a standard set of best practices for much of anything. As another commenter said, though, this is not the case in regulated industries, in the parts of those companies dealing with regulated processes, controls and data access.