"Security is more than simple compliance to guidelines. Just because you are compliant doesn't mean you are secure"

If complying with guidelines doesn't achieve (an appropriate level of) security, then you're using the wrong guidelines. Simple as ...