Even well written standards are not objectively audited. There’s a huge variety in the quality of external auditing, and a fair amount of pay-to-play. A lot of

Even well written standards are not objectively audited. There’s a huge variety in the quality of external auditing, and a fair amount of pay-to-play. A lot of people will tell you that every PCI certified company to ever be involved in a breach was non-compliant at the time of the breach. Is that because the PCI DSS is such a remarkable standard that complying with it will protect you from 100% of breaches? Or is it because you can retroactively find some type of issue with 100% of PCI audits?