Mandatory annual security assessments are going to be brutal for small businesses.