[dragonwriter]

> The question is how many businesses really want to pay the money for somebody to audit their entire network security through the OSI stack at layers 1-7

If there was a mandatory requirement (e.g., had it been incorporated in the HIPAA certification requirements that the ACA required the Department of Health and Human Services to have in place and in effect for some HIPAA transactions by the end of 2013, and for all HIPAA data by the end of 2015), the question would be equivalent to “how many businesses want to be legally permitted to conduct business involving HIPAA-covered transactions and data”.

Or course, not only was that not in the regs, the regs were late, and withdrawn without going into effect, so there are no (not even lip service audit) certification requirements for entities in health care.

[walrus01]

Yes, agreed, the only thing that will really cause organizations to go through the trouble of an in depth audit is regulations with some teeth.