Teaching to the Test. Why IT Security Audits Aren't Making Stuff Safer

Honestly I think he gives them too much credit with “The intent of the frameworks is good”.

The frameworks do exactly what they were intended to do, sell enterprise shitware, sell audit and give companies a convenient excuse when they get hacked.