I'm always wondering whether these very abstract and incoherent standards actually improve or damage _actual_ real world security practices. I've seen whole departments at companies that used to be very focussed on protecting customer and company data shift focus to compliance measures with the effect of actual security getting worse in the process.