Tim Scott actually said...

We believe changes to CFATS that require implementation or enhance scrutiny of any single-risk reduction option such as the mandatory consid...

There is a significant cost to doing this.

There is a significant cost to upgrading security across the business.

We are not in support of mandating any single risk-reduction tool.