However, the IT pro who knows the regulation inside and out can spout chapter and verse right back at an auditor. A security pro who arms himself with regulatory knowledge can actually argue against auditors' over-reaching or unreasonable demands and hence can take up legitimate security concerns with management.

Taking up a conversation with management and curbing auditor idiocy is an art, however. "From a professional's perspective, there's no comparison," McDonald says. "I walk in to [talk to a prospective client], and [a competing] provider throws around acronyms like HIPAA [Health Insurance Portability and Accountability Act] and Gramm-Leach, and the exec's eyes glaze over."

What works is turning a geek conversation about security into a business conversation, McDonald says. "If you say 'Users want [a given technology],' it doesn't matter. It's a direct violation of regulations if you do it simply for convenience. If you say 'I must do it because I need to manufacture a missile,' fine. [Regulatory literacy] makes it easy for me to argue against an employee that says 'I want an iPod or a PDA or a network printer.'"

One last piece of advice comes from Anthony Scalzitti, a security engineer at a major security software company. When dealing with overzealous compliance personnel, Scalzitti encourages their enthusiasm and reminds them of the importance of due diligence. He then suggests that they interview other organizations of similar size to learn details of their security posture.

"Not only is this useful work but it gives them the opportunity to learn correct controls and later present them as their own," Scalzitti says.

He suggests seeding the list with an organization or two that are known to be well-run. In other words, not those with un-backed-up data centers located in Tornado Alley.

Lisa Vaas has been covering technology for 11 years, focusing on information security, data theft, security research, IT management, careers, databases, open source, business intelligence, and the technology concerns and needs of the midmarket.