It is important that any data security standards be based on reasonableness, taking into account the diversity of different businesses covered by the regulation.