[RicoElectrico]

The answer is political, not as much technical. Anyone worth their salt in ITsec should push back hard on "checkbox compliance" and lobby accordingly in a standards body or regulator responsible for their vertical.