I’d be curious to see if this actually enforced and for how long. I see companies cutting costs on security all the time. You can’t really trust them with anything else than creating and optimizing processes to make money. I’d rather see public regulators eat their turnover until they comply.