[rcxdude]

I think the law itself only mandates a very small section of that standard: more or less 'no common default passwords' and 'have a means of reporting security bugs'.