Regulatory Compliance: Inflexible in Security