[iancarroll]

I have seen companies pass audits with just XProtect, but I think it highly depends on your auditor and the wording you use to justify it.