I think I also agree with @nathan_long's point, in that perhaps the government shouldn't be concerned with the how data is kept safe, but rather than track breaches and complaints... that would be what leads to a revocation of status.