smaller companies often will do 1 of 2 things, both for the same reason. 1. They'll over-adhere to regulatory compliance/security 2. They'll under-adhere to

smaller companies often will do 1 of 2 things, both for the same reason. 1. They'll over-adhere to regulatory compliance/security 2. They'll under-adhere to regulatory compliance/security. It's often done for the same reason: ignorance. It's a question of culture/personality, do they play scared or fast and loose? often times smaller companies don't have the money or the time to develop the expertise they need in the regulations, hence why they make guesses and over or under adjust. One of the reasons I dislike "security" people so much is that they often turn into a combination of 1. no real idea what they're doing 2. a tendency to over-adhere, and 3. a belief that security automatically always trumps other concerns.