NIST 800-171, if that's what this is, is actually a decent set of regulations. I find, however, that the software solutions that are available drive companies to use just a few solution providers that creates concentrated points of vulnerability.