. . "Now I know the intention of the standard was not to do this, but for most organizations when Security is only a COST, they want to just do it with the least possible budget." . .