Absolutely agree that the incentives have to change!

What does the FCC consider to be "reasonable measures to protect the confidentiality of its customers data"? Is there a document somewhere that outlines the best practices they expect you to follow?

I might be able to better convince my employer to prioritize security work if I had something like that to point to.