Embed Notice

@horse

Fair enough. But are we sure this isn't confusing correlation for causation?

I worry that the policies and procedures become an end unto themselves, for checkbox compliance.

Your observation can be explained by thinking there are robust security cultures, and weak ones, and the robust ones both understand the value of having and following frameworks, and also have good practice. But it's not clear to me that the frameworks cause the practice.

The culture causes both.