I work in the industry and partially disagree with OP. There is credentialling BS but it's not regulators that push that. Regulators like the SEC instead requ

I work in the industry and partially disagree with OP. There is credentialling BS but it's not regulators that push that. Regulators like the SEC instead require disclosure of breaches when they happen, and agencies like CISA have stepped in to remediate and fix deficient organizations after an attack (Hartsfield-Jackson Atlanta International Airport is a notable example) Now with Chevron removed, a breached entity could sue against mandated disclosure or government mandated remediation.