Canada

The devil will always be in the details. How they implement the requirement will decide if it is a good or a bad thing

That being said, secure coding practices is generally the most efficient way to improve security posture these days

Anecdotally, having met Tanya a few times, she knows what she's talking about. I'm optimistic if she's helping shape the legislation

I generally want fewer contractors building government software, and more in house talent.

We definitely over pay on this.

100%. The incentives and interests of private firms and their employees are different than those of gov't agencies and their often unionized workforces.

I work as a contractor alongside regional gov contractors.

These people were outsourced with their jobs to an external company - think IBM - who maintains the unionized employees and does the circus around TPS reports and timesheets. They either went with their jobs or they were laid-off, and the gov got to move some numbers over to OpEx from Payroll. Woooo for the optics win?

Fast forward. Now 18 years later, same staff except for retirement and a mild exodus after some toxic micromanager explored the Dead Sea Effect (who left when his policies were frustratingly over-ridden by the CoVid WFH change). The employer who outsourced them pays 5% less, has a worse contract for after-hours and workload, and is actively looking to downsize for the same optics again (our pro-people government is cosplaying fuckwit conservatives here) with more work given to the leftovers.

Yes, the original employer does pay a premium on top of the wage for the contract staff, but that's lost to the management and especially redundancies with the segregation. Staff gets that nickel more, due to the worse contract the I sourced got. But, like the CBC, staffing and knowledge isn't lost when the regime changes.

That's my point. Yes, there's a lot of pork lost in the gov<->corp interface because corps are shit. But it's not all cut-and-dried, since in this case the corp (changed hands 3 times, same staff. Same middle-mgmt as outsourced with them) provides more stability than the unionized original employer, and a contract with better work-life balance and WFH.

Don't kill them all. This one wins on cost-benefit, IMHO.