Prove compliance and pass every audit
Publicly traded or not, auditors and regulators expect the same thing: a documented, tested data protection and recovery plan you can prove works.
In practice: an audit notice goes out and the evidence packet is already scheduled, not assembled that week.