You should have seen how much harder life got at our company when we discontinued a common root password across the back office. Things that used to take 5 minutes to fix by self-service now take a ticket to the owner of a system, which can take days.

Example: audit all employee access to PII data.

Anyone who's worked at a large company can tell you how incredibly complex and expensive this can get if your systems aren't designed for this.

Implementation of policies has a waterfall effect throughout the org.

EG: Adding something as simple as a privilege expiration (generic example) and propagating it through the org and various teams itself will take time.

They're hiring 2/3rd more employees to act as content moderators from the sounds of the guidance.

That’s upside down, me thinks.

It would be difficult to incur a 50% increase in expenses without massive policy shift.