Worse than compliance failure alone is if the failure is caught because of a security incident. Investigations and reviews ...