I think what he meant was, "Security is not the sort of process like the
Common Criteria, where you just have to go down a checklist to be good
to go." The process you describe and a process like the Common Criteria
are entirely separate types of things.