take more time and filling them out takes some more time. We're talking months here. By the time you start ticking off checkboxes (assuming that you were fully compliant from the start, which in my 10+ years now never happened, not a single time) you're already about 8-12 months behind the reason the law was passed for. And a year is a long, long, long time in IT security. You may rest assured that all companies that got sacked were fully compliant with laws and regulations concerning security. Which essentially means jack when it comes to "real" IT security the way the average geek would think of it. Don't mix compliance with security, they're two very different beasts and sadly, the former is more important to the average CEO than the latter. Because there's very specific laws for the former, but usually just very diffuse ones for the latter. Well, something tells me this is in response to legal activity. There are surely going to be new laws, probably not ones specifically in response to hacking activity, but others that allow various governments all sorts of access to records to track down hackers. The idealist in me wants to believe that we could also get more laws passed holding corporations more accountable for lax security. The realist in me realizes that such laws will first of all not be forthcoming, and second of all, even if they were, wouldn't do a thing. Or, worse, hit the wrong ones. Laws "against"