Tiered requirements scaled by size and/or impact is an obvious middle ground between equal obligation to all entities and a binary on/off status.

As an example of impacts not necessarily correlated with size, a comms platform for, say, the banking or finance communities, or defence and military systems, would likely have stronger concerns than one discussing the finer points of knitting and tea.