All the extra red tape and auditing doesn't come for free, so startups and SMEs without huge amounts of cash somehow lying around will struggle. Also, nothing

All the extra red tape and auditing doesn't come for free, so startups and SMEs without huge amounts of cash somehow lying around will struggle. Also, nothing about compliance is actually about "consolidating security debt" or "quick decisions". It's about paying someone to go through checklists and, like a reviewer of a scientific paper, find something, anything, no matter how inane, to criticize, before handing you a certification. Any slightly unconventional new idea to improve security in your product will be suffocated beneath the blanket of compliance. > I'm totally rooting for this because its the only thing that will improve security. So does the author. Well, they strongly endorse a sensible version without the vague phrases and open-source-killing blanket statements, and without brain-dead sentences like "your product must be un-DDoS-able". I do wonder, though, why you're rooting for legislation that would kill any open source project that might, conceivably, be used in a commercial setting?