My experience was vastly different and that's the problem. These aren't guidelines they are laws and you're at the mercy of whoever is investigating you. I'd r

My experience was vastly different and that's the problem. These aren't guidelines they are laws and you're at the mercy of whoever is investigating you. I'd rather not give too many details but one of the companies I worked for was fined a large amount of money after a security breach that was the fault of the hospital and not our application.