I don't know about it having to be an ISO standard but certainly it MUST be the industry equivalent of "don't roll your own crypto" but for user level authentication. This is indeed ridiculous.