And in the case of China there is even a fairly good chance of the requirements being adhered to as the government of China has shown itself willing to hurt the big bosses not just the underlings when a company goes against its wishes.

IIRC for Y2K, all board members of Chinese air carriers had to be airborne at zero hour. Pretty compelling!

...establish teams to monitor security constantly.

Yes, can we have some of that please?

If private companies are to perform public duties (water, power etc) it would be nice if they put the service before the pocket (profit). But since they don't: legislate.

And that is why unregulated capitalism cannot be accepted at a governmental level.

Without governmental meddling, there is no industry that would, on its own, decide to implement filters to reduce the pollutants being spewed in the air.

Without laws, no company would say "let's not dump these toxic chemicals into the river and, instead, spend millions every year on water treatment".

None of that would happen because capitalism is "shareholder interest" and that interest is money, not the environment.

The Internet has taken up such a space in our lives that it has reached the level of a public utility. Companies, however, are still doing whatever they want, deciding on what level of IT they are willing to pay for to make things work. The only reason there are any security protocols in place is not for the safety of customer data, it's for the safety of the company - because down time costs money and makes for lost sales.

We do need laws to bring home to the Board that their customer data is a treasure that needs proper protection, not just good-enough-protection.

We're getting there, but China is clearly leading the way.

Agreed.

In a thread a week or two back someone asked "What's wrong with capitalism?". You've answered that nicely.

Focussing on ICT, the unfettered reliance on information systems, specifically internetworking, by (essentially) all industries has created a house of cards. This is not only limited to capitalist states, but as you say, they inherently are not regulated sufficiently. This needs addressing by those knowledgable, ie. not politicians with a limited time in office. But parliaments create laws, so the relationship between the politicians and the "knowledgable" needs to be managed first.

None of that would happen because capitalism is "shareholder interest"

That's rather a corporate socialism.

I disagree ever so slightly. Capitalism optimizes itself to maximize profit by delivering what customers value - i.e. what customers will actually pay for. If customers valued clean air, clean water, good working conditions, environmental policies, etc., then they would prefer companies that prioritized those things even if they had to pay more for their products. Those companies would then make more money for their shareholders, and their competitors would have to change or go out of business. That's capitalism. The reason we need regulated capitalism is largely due to the hypocrisy of us, the customer. While most of us would say, for example, that the environment is important, if it means paying more for stuff or waiting longer for it to arrive from environmentally responsible companies then principles go out the window.

Today's customers want the cheapest thing, delivered the quickest with no delivery charges and today's capitalism has optimized itself to do just that.

"... China is clearly leading the way."

Indeed. My own personal experience tells me that China also led the way in offensive intrusions into computer systems in industry and commerce all over the planet. I can only surmise that this latest move by the Chinese government must be a response to the fact that the rest of the planet is catching up with their offensive capabilities.

" ... establish teams to monitor security constantly "

This is, and always has been, the key. However monitoring is not widely understood. Indeed international security standards contain very little guidance to date, and the almost exclusive emphasis has been "vulnerability reporting".

In reality, monitoring must incorporate multiple threads of activity: changes to the threat landscape, changes to the organisation's external state (e.g. third party changes, customer behaviour change), changes to the organisation's internal state (e.g. new services, reorgs, acquisitions), day to day changes in operational performance (e.g. network activity, resource access) and more. Every organisation's risk management function should include all such monitoring. The problem is that it doesn't show a continuous financial reward, so it's looked on as unnecessary until after the data breach.

Agreed.

...it doesn't show a continuous financial reward...

Much like Health and Safety.

Most H&S related incidents are limited locally, few have wide geographical impact (exceptions being core meltdowns and the like).

Because H&S risk is observable by the "commoner" it has been addressed. Yeah, it took a while. ICT risk is not so easily understood by non-techies ( cf safe backdoored encryption as desired by FUD pushers). So, not only is pushing safeguards through legislation retarded, it's unlikely (in my mind) that it'll be done correctly. I'd like to optimistic and hope I'm proven wrong.