@skylar @gabriel I was doing a cybersecurity plan a few years ago and everything is COMPLETELY hostile to actual security and oriented around, exactly as you said, checking boxes. If you do something novel or better, you can't check the specific box; automated vulnerability detection tools get confused and penalize you; auditors argue with you. It was really demoralizing.