Having gone through ISO 27001 and PCI DSS level 2 I kind of assumed all of these security focussed compliance standards are just that. Anyone have any exceptions?