Linux Kernel Security Done Right (Google Security Blog)

It depends on the specific regulations.

Some are written so that anyone can 'meet them in the field' and others are written that you must run XYZ code as certified by ABC firm of auditors and published in DEF registry. My understanding was that if you are needing to meet the second set of certifications, you don't get the latest kernel/library set they publish.. you instead get an old set which did meet those certificates and is backported patched in a way that whatever regulation allows for.