Comment by gopher_space

If your clients will let you pass the buck on security like this it would be very tempting to work towards the least onerous insurance metric and no further.