Comment by lokar

All of the audit / certifications are theatre. the only question is if your customer is required to participate in the show.

If you really care about security, you need to separate it from this stuff, it can only hurt you.

Do your own, real, security, and treat this compliance stuff as an opaque customer feature request.