Automating security compliance too often focuses on patches and vulnerabilities. Highly regulated industries like NIST, HIPAA and PCI-DSS demand more than just static, dynamic and runtime tools. Regulations demand knowing your users, measuring training and managing disaster recovery but automation lags here. This talk discusses integrating requirements and automating non-vulnerability standards. Using unified mark-up language integrates requirements and common tools can link users, integrate contingency plans, and expedite compliance to increase value.