They're one and the same thing. Compliance is a way of demonstrating that you have met certain data and information security standards.
There are very real consequences in the real world when these checks get skipped or overlooked.
That goes double when "terrorism" is brought up, which is a metasituational justification for nearly any conceivable rule.