[throwaway290]

They want compliance not security. Maybe if it's enough for compliance but not enough really then whoever makes compliance standards should be fired