Is an individual’s privacy the government’s sole concern? No, it is not. These laws have four major beneficiaries:

• Individuals—A number of laws focus on protecting an individual’s private information.
• Shareholders—A number of laws are designed to provide confidence in the markets. When investors believe that a company’s financials and risks are properly managed, they feel they can make informed judgments. This promotes a healthy economy.
• The public interest—This term reflects the idea that an organization has an obligation to the general public beyond their self-interest. Although this is a vague term, regulators often look at the impact a company has on the industry group or the economy in general.
• National security—The idea is that cyberterrorism threatens not only the company being targeted, but also the country’s critical infrastructure.

To be clear: The world is not perfect, and the goals of regulations are not always achieved. Regardless of the value you place on regulations, you shouldn’t treat them as abstract concepts. Regulations do affect security policies. They limit how business can collect, store, and process information. Security policies are looked to as a way to ensure compliance with government mandates.

It’s an accepted concept that when everyone has to follow the same rules, the playing field is level. Without regulations, companies feel the pressure to take shortcuts to maintain competitive advantage. Regulations remove some of this pressure because everyone must comply. In other words, doing the “right thing” becomes not a matter of cost or advantage, but part of the business culture and the law.