It's not enough to be compliant, you have to prove you are secure.