Meeting regulatory requirements is a "minimum standard" and does not project true security.