Reasonable Security

“Reasonable security” is a phrase that appears repeatedly in statutes, regulatory guidance, enforcement actions, and judicial opinions. Its imprecision is intentional. Rather than prescribing a fixed set of controls, the standard is designed to be applied contextually, with judgment exercised after an incident has occurred. For regulated professionals, this has a practical implication that is often underappreciated: security decisions are rarely evaluated when they are made, but when they are later reconstructed.