First, there’s compliance with standards, certifications and codes of practice that offer assurance that best practices have been followed. Whether around products or procedures, complying with non-binding guidance can secure better deals with insurers and reassure stakeholders, as well as bolster security. Alternatively, compliance can be about following the law, with regulations invariably relating to areas other than security, such as data protection and health and safety. However, security professionals must convince boardrooms that bare-minimum compliance alone is not necessar...