agree, but also point out that this argument can be expanded to essentially make all such efforts meaningless - actual security is never captured by these documents, because it is a function of the system itself, and these documents can only by definition point to some aspects of it...

p =~ np, what can I say.