I worked in this industry for a while (am still adjacent to it). This is a well-written guide, as far as I can tell.
The thing it wouldn't mention is that very, very few companies actual care about complying with data security standards for the sake of keeping PII and sensitive data safe. They are more than happy to do the absolute minimum to pass an audit, and the absolute minimum is shockingly little.
What they really care about — and what lights a fire under them in the way that basic ethics and common sense apparently does not — is passing vendor security reviews.
Shout out to companies with very strict assessments, who actually pay attention and weed out companies with bad practices.
The thing it wouldn't mention is that very, very few companies actual care about complying with data security standards for the sake of keeping PII and sensitive data safe. They are more than happy to do the absolute minimum to pass an audit, and the absolute minimum is shockingly little.
What they really care about — and what lights a fire under them in the way that basic ethics and common sense apparently does not — is passing vendor security reviews.
Shout out to companies with very strict assessments, who actually pay attention and weed out companies with bad practices.