Whenever you're ready, walk me through how you'd approach this.
What is your experience with implementing security controls in compliance with industry standards?