In a way DoD (STIGs), NIST, Mitre, SANS, OWASP are all different takes on the same general idea.
Reply on news.ycombinator.com