Some years ago I was consulting for a new credit union; they found their implementation choices very constrained by the NCUA (regulators).

I had to walk away from that job. I told them I could not take responsibility for the stability and security of their systems with the constraints they required.

Was a horror show. No logs. Public IPs for the DB server, for vendor remote access. "We don't know what our originating networks might be, so no firewalls on that." "systems" networks and "public" network is too confusing, we need to be able to access our porn from any terminal, alongside client financial data.

That place was not representative of the industry, I think; but I still hope that the situation improved.