Should IT leaders incorporate the language of compliance frameworks into their security posture?

When are we as leaders in the industry going to rise up and have some control over these framework organizations so that they will start recognizing the evidence that I collect and not needle me to death? The evidence has the same intent of the law versus the letter of the law. I've got the evidence there, I just have a different term. For example, instead of my “objective,” it's my “goals.” But it's still there.

Unless there is a massive invasion by aliens to come in and eradicate every lawyer on the planet, you're going to have to close one eye and determine whether or not the language fits and interpretation versus letter of the law. Unless we're mandated by a higher being that says, “Follow this law. This is what this means and there are no deviations,” then we just have to do our best. I've gone through too many others, like HIPAA, HITRUST, PCI, and everything else; I'm going to do my best and the rest has to come after that. 

When you're talking about security, it all has to be highly customized and subjective; you cannot have one framework that is perfect for everyone. There are concessions there because you have different requirements, different needs, etc., and we don't have an endless amount of money to spend.