[actionfromafar]

Off prem is also a rats nest of regulations.

[agilob]

Yes, but it's done once, on demand for each customer and service-wide certificates don't expire for a few years or releases, so the cost is lower.

[Spivak]

Yep, I worked at a med-tech company and one of our biggest-value adds was that we were HIPAA compliant and part of Direct Trust — 10k customers one certification.