How do you handle working with a difficult client who is resistant to implementing mandatory security controls?
