The problem is that a regulation like &quot;be secure&quot; is impractical, because to a close approximation no system is actually, 100% secure - it&#x27;s just a matter of the effort taken to hack it.<p>So the regulation ends up being &quot;go through the security process&quot; (take something like PCI compliance as your model).  This always ends up being a crappy fit because the guy doing the process can typically only throw out a list of &quot;best practices&quot; that may or may not make any sense for any particular application, and in any event aren&#x27;t comprehensive enough.  It&#x27;s also wildly expensive, since the process is embedded in a regulatory-certified person who charges N$ &#x2F; hour.<p>Empirically the best you can do absent some specific industrial setup is a series of bright-line rules like &quot;don&#x27;t store passwords in the clear&quot;, but that&#x27;s far from sufficient.