> that being far too dynamic and technical to encode in regulations First, that would require the regulating body to actually now what security is and how it w

> that being far too dynamic and technical to encode in regulations First, that would require the regulating body to actually now what security is and how it works in the real world, in real companies. Then, it would require having an open mind regarding the risks and forget about 30 years of long gone history. If you look at ISO27002 (derived from the British BS-7799 30 years ago) you will note that it addresses very general ideas without a link to the reality of the field. If we had 5 rules that address real-world issues we would be light years ahead. Something like "a patch from teh vendor must be applied within 24 hours" (yes, one in a blue moon it will break things and slow down some fantasy "quarter end"), "MFA on all accounts used by humans" and 2-3 more like these. Just ask the people doing actual security 9-12 and then "compliance" 13-17, two totally disconnected activities.