talking about that thing. does it only apply to some business/org. ? when a big bank launders money for years they get fines and continue to business like nothing happened, this happens every few years.

A thing that doesn’t apply to information security