The US Congress holds tremendous power and shapes the way IT related regulations are envisioned and enacted. The whole idea is to develop a system of checks and balances in order to prevent potential abuse and safeguard the interests of nation and its people. While the intent is noble, when it comes to interpretation of regulations in terms of understanding implementation requirements and impact on business, and finally corresponding development/deployment of IT policies; most organizations seem to be struggling and spending millions. Can we do any better?