SOC2, a standard governed by the a CPA certification body, costs billions of dollars a year to collectively implement and doesn't meaningfully improve security. FDA auditors trying to regulate software development for clinical trial data capture makes clinical trial software cost ~30% more AND makes it lower quality. There are costs on both sides of the continuum. The costs for bad regulators are just diffuse.