Where I work Compliance and Security are completely different departments. This is great because the Security department does whatever they think is best for security, regardless of compliance requirements.
The Compliance department has one job: passing audits. They never tell Security what to do; they document "compensating controls" and if that's not good enough for an Auditor the Compliance department will run whatever worthless compliance control themselves.
I'm not saying security compliance itself is a joke. It forces small businesses to at least try to get their shit together. But for big tech companies with real security programs, security compliance is a worthless tax.
