Regulatory compliance is the bane of many a network admin’s existence, and many organizations whose leaders think they are in full compliance really aren’t. That’s not entirely their faults; the requirements can be difficult to decipher. Another problem is that you may be making assumptions about your security that just aren’t true, or relying on assurances from others who are making such assumptions and/or who don’t understand the requirements. Read this article about five dangerous compliance assumptions to be sure your organization isn’t making any of these mistakes:
http://www.darkreading.com/compliance/blog/232601336/five-dangerous-compliance-assumptions.html