I might suggest a construct like this too.

What do you think how much it cost to do it perfect?

Lets say these are paper records, behind a locked door, with a security guard that they check id for it. If someone then breaks in at night time, cuts the cameras and knocks out the security guard and steals a filing cabinet, should that university then be fined 10% of revenue, which could mean the entire university shuts down because most businesses cannot survive that? We have to remember who is the original criminal here.

They can try:

* various education campaigns

* force users/customers to adopt passkeys or other phishing resistant mfa

* add various alarms and alerts for unusual activity, resulting in lockout

The problem is that even after adopting all of the above, it's still not too hard to breach virtually all companies, and there is massive user opposition to the last two.

Calling "shell company" makes it sound like the University is the shareholder, but that's usually not what's happening IMHO. In general the entities are clearly defined and nothing crosses the client/contractor frame, the university just happens to be the sole client and the contractor will have the uni pay for their whole operation.

Seagate will not in a million years sign anything like this when you buy a HDD.

Sort of like EULA's a lot of the "value" is incredibly theoretical.

guess who holds the bag if capacity needs collapse

You can’t. You don’t need source for that, just common sense.

Exploits are discovered every day, bugs happen, bad actors.

You can do the best system, shit still happen.

BTW you want a source ? Remember when the freaking CIA data got leaked ? Edward Snowden, ring a bell ?

If the cia couldn’t prevent it, I bet you can’t.

You can make a system "more" secure than other systems, but you cannot make it truly secure.

For one, the lack of any secure computing systems.