>there are very few regulations that can effectively capture the intent of the rules instead of "tick boxes" that might or might not mean very much.

>set mandatory qualifications for IT workers/devs to ensure a base-level of security/understanding

What is it about this regulation that prevents it becoming a useless box for IT pros to check?