Anyone holding such information on the internet should be required to have their systems independently tested on an annual basis. Many company's have audits of their financial records and internal controls. Why not audit the security controls of their network?
