Sir we have two options for our data security, the expensive option which keeps to standards, or the cheaper option that is fairly suspect and covers our ass about as much as a leaf.
"Well, we can't afford teh good option due to cutbacks, so go fo rthe cheap one"
*several months pass*
You're being fined for failing to protect the data.
"But now we've got even less funding! Crap how are we gonna survive now."
sirt we have a new system set up, but we need to work out the data protection, we can either do it the right way which is expensive, or the shoddy way which is cheap
"Well thanks to the cutbacks and fines we can't afford to do this right, cheap and shoddy it is!"
And so the cycle continues.