Since most of what these teams do is box-checking for these certifications, it's true.

Security is a process. It's not a constellation of products or certifications.