Many IT teams are irresponsible though. I have a client now that has revenue of $1B and has no legal review process and doesn’t require IT vendors to submit SOC 2 certifications or any other security attestations.