Tl;DR: Part 2 of 3: This episode is the set-up, the problem statement, and overview of Bo's approach, in a 3-part series presented by Bo Birdwell, on how to build a defensible security program using compliance to drive greater security improvement. The accompanying video is a must-watch because it has the slides Bo is talking through, and you're not going to want to miss that.