It's security theater. Friendly plug for Oneleet, who actually talked us out of getting it.
We were considering getting certified, but it only really makes sense if your customers require you to have it.
We were considering getting certified, but it only really makes sense if your customers require you to have it.
And another question but as a consumer, is there any certification which can meaningfully try to show if people/business take their security carefully or are all things security theater in that aspect and at some point, we just have to trust the enterprise and look for other signals of security (like for example blog posts which might show a deep-dive into security for example comes to my mind)
Also, not to mention in many countries, the cost of getting breached is nothing so many companies are willing to just hope for the best and payout in case of the worst.