That's simply counter to how $BIGCOs work. Just look at infosec for a big corporation. There's no incentive on their part to minimize cost or disruption with st

That's simply counter to how $BIGCOs work. Just look at infosec for a big corporation. There's no incentive on their part to minimize cost or disruption with strict security policies and audits. The people who feel the pain are the workers, not the CISSPs pushing STIG hardening rules. And if the C-Suite starts to wonder if all the time and money is worth it? Just show them some news reports of breaches. In many industries (especially highly regulated ones), the entire audit world of Deloitte et al is designed to make things unproductive.