Companies have greater security risks when following standards

    A common occurrence for many businesses is that they become so focused on following industry guidelines and checking off boxes to ensure they are following these requirements, they lose track that they also need to prevent cyber threats.  By being overly concerned with meeting the requirements of government and industry standards companies are forgetting the big picture.  They are leaving themselves open to becoming targets of cyber criminals by being unprepared. 

     To prevent this from occurring companies need to expand their security guidelines to include greater threat assessments along with industry standards.  They need to place their focus on going above and beyond industry standards rather than just meeting them so they are in compliance.  This will help secure their businesses by staying one step ahead of security threats rather than waiting to take action until it is too late.  Companies who have not experienced cyber attacks do not realize the importance of increasing threat assessments.  They must take the advice of others who have experienced cyber threats and take necessary steps to prevent it from occurring to their company.  If industry standards do not change to include greater focus on cyber threat assessments companies need to take it upon themselves to increase it on their own.

See the link for more information  http://www.computerworld.com/s/article/9237254/IT_security_managers_too_focused_on_compliance_experts_say