Last of eight. Building something secure is one job. Proving it to a customer, an auditor or a regulator who has every reason to be sceptical is a different one — and it is the job the rules are now catching up with.