They are required by federal law and regulations to comply with tighter security than what they demand of commercial organizations.
Most of them don’t comply with the laws any more than most commercial orgs do.
Unfortunately the vast majority of companies will not secure customer data unless forced. I’ve had many C level executives tell me they didn’t want to know where the problems were. I still have organizations tell me the danger is vastly over stated and nobody is going to target them.
Hillary violated numerous laws with her server. I’m not going to hold my breath that she’ll pay for it.
Well, when a private co. doesn’t care about customer/corp data; they are beholden to the audits and customers/reputation. Too many dings, customers to elsewhere, and co. goes belly-up...
What happens when govt doesn’t follow the law?