Good information security professionals don’t need a regulation to tell them it’s important to protect their business. But, overprotecting the business? That’s another matter. Section 404 of the ...