Understanding data breaches, it's not "if" but "when".

Meeting regulatory requirements is a "minimum standard" and does not project true security.