Achieving evidence-based security with threat-informed defense

While compliance-based frameworks are not without merit, it is important that they be viewed as minimum acceptable standards and not as end goals.