I worked in orgs where customers put a certain security standard in the contract. So if you fail that you are kind of in breach of contract