Your first sentence isn't necessarily true There is compliance everywhere and compliance is often complying with larger industry "requirements" or considered b

Your first sentence isn't necessarily true There is compliance everywhere and compliance is often complying with larger industry "requirements" or considered best practice controls. If you start a business from scratch, I don't know any company that has developed their own controls library from scratch without complying with some sort of framework or baseline controls set. The frameworks and control sets that you often comply exist and are there for a reason, but your mileage may vary if you choose to use them.