When security needs are stated in terms of achieving a compliance requirement, management is far more likely to listen.