Why Controls-Only Compliance Fails Connected Device Security

when you start looking at any kind of compliance standard, the first step is typically to do some kind of controls only approach. So this is looking at contextualizing your risks exclusively through the lens of security controls. So this includes typically interviews and paperwork review, maybe some kind of gap analysis to understand which products are beholden to which regulations, by what timelines, what teams are responsible for those products. We've all been through these types of kind of granular controls assessments, and the technical depth that is kind of needed to contextualize those risks in the real world is something that usually has to get handed over to another team. That is block number one to you being successful.