It took, depending on when you say who the first "engineer" was, several hundred years (let's go from Christopher Wren to the 1828 charter of institute of civil

It took, depending on when you say who the first "engineer" was, several hundred years (let's go from Christopher Wren to the 1828 charter of institute of civil engineers). So we have time. But we could easily establish minimum best oroactises for computer security, data security, PII management etc (we more or less have with say SOC2). This is why the people that asked "when was your last penTest" got it wrong. They should have said "show me your SOC2 certificate". Then whatever lies the salesman says are obviated by going and asking the accreditation agency. All we need to do is migrate the SOC2 from a paid for box ticking exercise into something valuable