Good security will almost always make you compliant (or pretty darn close, not counting all the documentation). Compliance alone will pretty much never make you secure.
‘Nuff said.
(Inspired by this from Rothman, who I swear isn’t giving me kickbacks) *[Email:]: Email *[Twitter:]: Twitter *[Phone:]: Phone