Actually, just got started with one - IT compliance for a fairly large entity. Oddly, the CIP standards are vaguely comforting. They are at least a stationary target.

I came from six years in the financial sector--GLBA is more like trying to find a black cat at the bottom of a coal mine. Totally subjective, with examiner skill level ALL over the map.

Anyway, send me an email if you want to commiserate sometime. jbaxter at my website domain name.