I'm sure they've got a dozen get out of jail free cards in their contract. And you can never secure well enough to guarantee someone can't break in.

Then it's a matter of: Did you do enough compared to "best practices"? And the standards are worthless. I sat through many security reviews when I was sure our systems were full of holes and the guy in charge of the security would smile at the auditor. The auditor would point out the security hole. The system administrator would pick up a best practices manual and point to the page where he fulfilled the requirement. And then they went on to the next item. Again and again.


"Best practices" hides a lot of failure.