Last time, I said I'd have to stop myself from digressing into the Titanic. Consider this me keeping that promise: today's analogy stays on dry land, in a restaurant kitchen.
It's 2:30 on a Monday afternoon, and the health inspector is working her way through the kitchen of the best-reviewed restaurant in town. The floors are spotless. The walk-in cooler reads 36°F. Every log is filled out, signed, and dated. She writes down her score, and by Friday there's a large letter A in the front window.
On Saturday night, the cooler's compressor starts to struggle. The temperature log gets filled in at 4 p.m. (for the whole evening) by whoever has a pen. A line cook, three weeks into the job, wonders about the chicken and says nothing, because nobody ever told him he was allowed to.
So what did that A actually tell you? That the kitchen was clean on Monday at 2:30. About Saturday night, it said nothing. That isn't a flaw in the inspector. It's what an inspection is.
Where does this fit in the series?
This is the second article in the Beyond the Checklist series. In The Illusion of Security, we looked at audits (SOC 2 and ISO 27001), and why a clean report isn't proof you're safe. This time, I want to go one level up, to the regulations themselves: the laws and mandates that decide who gets audited, against what, and on whose clock. If the audit is the inspector, the regulation is the health code.
Disclaimer: I like regulation. Mostly.
I'm not here to bury regulation, any more than I was there to bury audits. Before California's breach-notification law, SB 1386, took effect in July 2003 (the first of its kind), whether you ever learned your data had been stolen largely depended on the company's goodwill. Versions of that duty now exist across the US and well beyond it, and attackers no longer get to count on silence.
Sometimes the effect is even measurable. In 1998, Los Angeles County began requiring restaurants to post their hygiene grades in the window. Economists Ginger Zhe Jin and Phillip Leslie found that inspection scores rose and foodborne-illness hospitalizations fell afterward. Researchers still argue over how much credit the grades deserve.
Winston Churchill told the House of Commons in 1947 that democracy is the worst form of government except for all the others that have been tried. He prefaced it, a little slyly, with "it has been said." Indulge me while I add my corollary:
"Regulation is the worst way to drive security, except for all the others we've tried."
"Asking nicely," I'll note, has a poor track record. It is almost like asking AI vendors to regulate themselves.
So why call it a trap?
Because the trap isn't the regulation; it's what the regulation invites us to do: manage to the rule instead of the risk.
A health code is a floor: the minimum a kitchen must clear to be allowed to serve food. Somewhere along the way, a great many of us in cybersecurity started treating the floor as a finish line. Compliance ≠ security, once again, only this time with the legal system's fingerprints on it.
What's wrong with the way regulations work?
Same two buckets as last time (a series ought to have some continuity, and I'm apparently a creature of habit). Systematic deficiencies are baked into how regulation gets made. Operational deficiencies are what we (and our customers) do in response.
Systematic deficiencies: what's baked in
🔹 They arrive late and leave late. The HIPAA Security Rule dates from 2003 and was last substantively updated in 2013. HHS proposed a major overhaul in January 2025 (including mandatory encryption and MFA). The target for the final rule has since slipped from May 2026 to July 2027 on the federal regulatory agenda. Rule-writing is genuinely hard. The lag cuts the other way too: defense contractors are still held to NIST SP 800-171 Revision 2 under a Pentagon class deviation, even though NIST published Revision 3 in May 2024. And sometimes the law shows up before the yardstick does. The EU pushed the AI Act's high-risk obligations from August 2026 to December 2027, in part because the standards needed to assess compliance weren't ready.
🔹 They multiply faster than they harmonize. Picture a US-listed financial firm with an EU subsidiary, hit by ransomware at 2 a.m. By the time the coffee's made, several clocks are running. DORA wants an initial notification within four hours of classifying the incident as major. NIS2 wants an early warning within 24 hours. GDPR wants 72 hours. The SEC wants an 8-K within four business days of determining the incident is material. And once CISA's CIRCIA rule takes effect, covered critical-infrastructure entities will owe a report within 72 hours and a ransom-payment report within 24. Not every firm owes all of these, but plenty owe three or four. Each regime has its own trigger word ("major," "significant," "material," "covered"), recipient, and form. In kitchen terms: one outbreak, five agencies, five forms, and five definitions of "outbreak."
NIS2 adds another wrinkle. It's a directive, so each member state writes its own version. The transposition deadline passed in October 2024, and the European Commission opened infringement proceedings against 23 member states about six weeks later.
The US has its own version. Every state has a breach-notification law, and they differ on triggers, deadlines, and even order. New Jersey requires notice to state authorities before you tell affected individuals, and Connecticut wants the attorney general told no later than the consumers. Other states, including California, ask for a copy of the consumer notice after it goes out. You can often thread that needle by calling regulators first, but that still leaves a sequencing plan for up to 50 jurisdictions, drafted while the incident is still unfolding.
🔹 They stop at your front door. A health inspector grades the kitchen in front of her. She doesn't grade the farm that grew the lettuce. This summer's Cyclospora outbreak made the point. CDC and FDA investigators traced it to shredded iceberg lettuce from a single supplier, Taylor Farms de Mexico, served at Taco Bell locations in five states. The largest cluster the CDC tracked, tied to that lettuce, reached more than 12,000 illnesses across 21 states. A kitchen could have been spotless on inspection day and still served it. (An A in the window was accurate about the kitchen. It was never a statement about the lettuce.)
Cyber works the same way. In my experience, most frameworks ask whether you have a vendor-management program, and far fewer ask whether the vendor is actually safe. When Change Healthcare was hit in February 2024, one clearinghouse that touches an estimated one in three patient records took down billing and payments for hospitals, physicians, and pharmacies, and some providers temporarily closed. Every provider downstream could have had spotless paperwork of its own. Newer regimes are reaching further: DORA makes financial firms register their ICT third parties, and CMMC can extend requirements to subcontractors. But "we keep a register" and "our supplier is safe" are still different sentences.
🔹 They run on political weather. The SEC charged SolarWinds and its CISO in October 2023; a federal judge dismissed most of the claims in July 2024, and in November 2025 the SEC dropped the rest, with prejudice. The disclosure rules that produced the case are still in force. Meanwhile, the Pentagon suspended CMMC Phase 2 (mandatory third-party assessments, due to start on November 10, 2026) on July 13, 2026, while leaving self-assessments and the underlying DFARS obligations untouched. Enforcement appetite is weather. Risk is climate. You can dress for the weather, but you have to build for the climate.
Operational deficiencies: what we do about it
🔷 We mistake the snapshot for the film. In September 2013, Target's CFO later told the Senate that the company's systems had been certified compliant with PCI DSS. Between November 27 and December 15, attackers took 40 million payment card numbers. Whether Target was truly compliant on the day of the breach is debatable. The card networks themselves describe annual PCI inspections as snapshots. But consider Verizon's forensic findings: of the breached companies its investigators examined over a decade, not one was fully PCI-compliant at the time of its breach, and only 29 percent of companies were still compliant a year after validation. Compliance has a shelf life. So does an A in the window.
🔷 We sign what we haven't tested. More and more of us lean on attestation. Under CMMC Phase 1, defense contractors self-assess and report a score into a government system. In September 2025, Georgia Tech Research Corporation agreed to pay $875,000 to resolve False Claims Act allegations brought by two former members of its own cybersecurity team. DOJ alleged, among other things, that the lab submitted a score of 98 (out of 110) for a campus-wide "virtual" environment rather than the lab's actual systems. The settlement included no finding of liability. For our purposes, what matters is that the case didn't hinge on a breach. It hinged on the number. That's the temperature log filled in at 4 p.m. for the whole evening (the trade calls it pencil-whipping).
🔷 We drift to the minimum bar. A pass/fail standard teaches a rational lesson: once you've cleared the line, every extra dollar is a cost nobody gets credit for. A SOC 2 report with no exceptions doesn't earn a bonus for the controls you built beyond it, and a kitchen that scored a 91 has little reason to chase a 100. (Every student who ever studied to the passing grade will recognize the instinct.) In my experience, budgets follow audit scope. What's in scope gets funded; what isn't gets a "next year." That's how organizations end up with immaculate evidence for the systems the auditor will sample, and a shrug for the system the attacker will actually find.
🔷 We pay for the label, not the contents. Here's a silly one. As I write this, Tractor Supply sells a 100-count bottle of antihistamine for dogs, 25 mg of diphenhydramine per tablet, for $9.99. Walmart sells a 365-count bottle of its Equate generic for people, 25 mg of the same drug, for $7.27. That's roughly ten cents a tablet versus two. I compared the inactive ingredients too (eleven of them, from corn starch to titanium dioxide), and the two lists match item for item. I checked the tablets themselves, and they are identical down to the imprint stamped on each one. Same active ingredient, same strength, same inactive ingredients, same imprint, at five times the price per pill.
So what does the extra money buy? Mostly the words around the pill. The dog label carries dosing guidance by weight and a nudge to ask a veterinarian first in certain cases, and that is real value. It's the part I would least want to guess at. Everything else is packaging and the aisle it sits in.
Here's where I land, and it isn't as obvious as it looks. I'd buy the Equate. I already trust that brand for my own medicine cabinet, and the ingredients are the same. I would still ask my vet about the dose, because the ingredient question and the dosing question are separate, and the pet label sells them as a bundle. (Yes, I compared pill labels for a LinkedIn article. This is what thirty years in security does to a person.)
Security buyers bundle questions the same way with attestations. In my experience, the vendor with the shiny report is assumed safe, the vendor with comparable controls and no report is assumed not, and we pay for the badge without asking what's in the bottle. The sharper move is the one the pill teaches: separate the questions. What is actually in the bottle? And who can tell me how to use it safely?
So which bottle would you choose, and why? Tell me in the comments. I'm curious where your trust lands: the label, the brand, or the ingredient list.
🔷 The audience stops reading the grade. A grade card only works if someone reads it. Consider breach fatigue, a term security researchers had been using for years before the Washington Post's Cybersecurity 202 applied it in 2021 to a T-Mobile breach affecting more than 40 million people. The column's point was that the public had grown so used to enormous breach announcements that even a record-sized one barely registered. Investors were less likely to abandon breached companies, and nearly every American had been a victim without taking cybersecurity noticeably more seriously.
The restaurant version is the hole-in-the-wall with a C in the window and a line out the door. People who love the food and trust the family behind the counter will eat there anyway. I'll confess to both sides: plenty of meals at A-graded chains, and the occasional visit to a local Mexican place with a C+ in the window. The grade told me something both times. I just weighed it against what I already knew. Customers treat breached companies the same way: they stay because the product works, switching is a hassle, and the relationship feels personal. That isn't irrational. But it means the market is a weak enforcer of the floor, and a grade nobody reacts to stops being a grade and becomes decoration.
So what do we do?
Here's the part I find genuinely delightful: the cure for the inspector problem was invented for astronauts.
In the 1960s, NASA needed food it could be certain was free of disease-causing bacteria and toxins, for people who couldn't exactly pop out for a doctor. The Pillsbury Company concluded that testing the finished product wouldn't be enough, so they set out to control the process instead. The result became known as HACCP: Hazard Analysis and Critical Control Points. Pillsbury microbiologist Howard Bauman, who had worked on the NASA effort, carried it into commercial food production. Regulators followed: the FDA required it for seafood in 1995, and USDA for meat and poultry in 1996.
What I love about HACCP is that it's itself a regulation, but it doesn't hand you a checklist. It makes you write your own hazard analysis, and then it holds you to it. That's the kind of regulation worth wanting: one that forces you to think like a risk manager. It also changes what inspectors see. Jenny Scott of the FDA's Office of Food Safety has described how, before HACCP, inspectors saw only a snapshot of the day they visited; now plants have to show records that reveal whether they're consistently in control.
Its principles (analyze the hazards, find the critical control points, set critical limits, monitor them, define corrective actions, verify, and keep records) translate surprisingly well to our world. Here's my version.
🔹 Start with your own hazard analysis, before you read the rulebook. Write down the five or six scenarios that would genuinely hurt the business: ransomware that stops order processing, customer data theft, a compromised supplier. Then overlay the regulations as constraints. Starting from the regulation gives you a list of what's required. Starting from the risk gives you a list of what matters. The lists usually overlap; the interesting part is where they don't.
🔹 Find your critical control points, and spend like it. In a kitchen, it's the cooking temperature and the cooler, not the décor. In your environment, it's a short list: identity (phishing-resistant MFA on privileged access), recoverability (restores you've actually tested), and detection on the path to your crown jewels. Failure there is catastrophic; failure elsewhere is merely annoying.
🔹 Inspect the lettuce, too. Trace your critical suppliers the way a kitchen traces its produce. Know which single vendors sit behind your critical processes, ask for evidence of how they actually operate rather than a signed questionnaire (the series will get to questionnaires, and I'll hold my fire until then), and plan for their failure with an exit path, a manual workaround, and a restore you've tested. Focus on this: a supplier that serves many of your critical processes, or half your industry, is a critical control point you don't control.
🔹 Set critical limits, and monitor against them continuously. A critical limit is a number with a consequence: a restore time you've committed to, a revocation window for departing staff, a patch clock for known-exploited vulnerabilities. When a limit is breached, a corrective action fires (automatically, if you can manage it). Evidence then becomes a by-product of operations instead of an annual scavenger hunt. It's the continuous-assurance idea from last time, with a better name for what you're assuring.
🔹 Build once, map many, and run one clock, not five. Pick a spine (NIST CSF 2.0 and the ISO 27001 Annex A controls both work), keep a single control library, and crosswalk it to every regime that applies to you. Test a control once; report it many times. The same logic applies to incidents: one incident record, one decision tree, materiality criteria agreed in advance with your General Counsel, and pre-drafted notices. When the 2 a.m. call comes, the question should be, "Which boxes do we tick?" not "Which rules apply?" Rehearse it with the full stack of clocks at least once. One walk-in cooler, five inspectors, but only one cooler.
🔹 Sign like you'll be cross-examined. Before anyone attaches a name to an attestation (an SPRS score, a management assertion, a regulatory certification), someone who didn't build the control tries to break the claim. Tester ≠ attester. Score the system that's actually in scope, not the one that makes the number look nicer.
🔹 Set your own bar, and report two numbers to the Board. Compliance coverage (how many requirements we meet) and risk coverage (how many of our top scenarios have tested controls). When the two diverge, that's the conversation worth having. And the gap above the floor deserves its own budget line, so it doesn't compete with audit scope for the same dollar.
🔹 Earn the trust the grade can't buy. Customers who stay after a breach are staying for the product and the relationship, not the certificate, so build the relationship before you need it. Publish a plain-language account of how you protect their data, name an owner, and when something does go wrong, skip the boilerplate. Say what happened, what you know, what you don't, and what you're changing. A numb audience tunes out the routine script; it notices the one that sounds like a person wrote it. (It also happens to be the blameless, learning-culture move, which I will pretend is a coincidence.)
One more, and it's the one people skip: show up when the rules are written. OCR received almost 5,000 comments on the HIPAA Security Rule proposal. The people drafting these rules do read the comments; the least we can do is write them. And if I could lobby for just one thing, it would be what Los Angeles did in 1998: make outcomes visible, in a form simple enough to read at a glance. It's the regulatory cousin of the audit exchange I floated last time, with one caveat: visibility only works while people still read the card, which breach fatigue erodes.
What's the question behind the question?
Last time, I suggested the real question isn't "Did we pass the audit?" but "How do we ensure we're secure?" Here's its sequel, and it's simpler: if the health department vanished tomorrow, would your kitchen run any differently on Saturday night?
If the honest answer is yes, you've found the trap. If it's no, you were never really complying. You were running a kitchen.
If you made it to the end, thank you. That's two long, dense articles in a row. I'd love to hear which pair of regulations gives you the worst clock collision, and what your team does about it. Next up in the series is Real Security vs. Excel Checklist Security, which, I promise, will not be a list. (It might be a list.)
Let's rethink this together.
Views are my own. Case details come from public records and reporting, and allegations remain allegations. Regulatory timelines are as of November 2026 and, as this article suggests, they tend to move.