Possessing internally maintained security programs is one thing, but having them measure up to industry standards and validating them by achieving best-in-class certifications is another. The latter is much more difficult and time-consuming, but if you want to be a safe and rigorously regulated company, it is necessary and worthwhile.