Thanks for the correction. I was really just going by what I've heard from colleagues, but my specialty is network security and the requirements may (or may not) be stricter there.