One of my favourite* things about security and compliance is guessing how to satisfy a requirement and then, when you guess wrong, the vendor/customer asks you to guess again.