> there are standards and operating procedures that can be used

99% of these standards are completely useless and exist only to reduce legal liability. The other 1% are only incidentally slightly useful.

You will never ever create a secure company by following some stupid checklist, unless the checklist is so extreme as to be useless to most orgs. “Step 1: only run OpenBSD…”

a checklist is not where it begins, but it is where it starts. if you don’t have it you probably don’t know what you’re doing

This is almost the exact opposite of the truth. People who know what they’re doing don’t blindly follow some checklist. Doing this properly requires deliberation, or an implausibly large decision tree.

i disagree. having a set of rules and a domain expert that defines those rules is key. automation around enforcement and designing the system to make it as less painful as possible are also key.

you cannot just say: oh this is so complicated that we cannot possibly have a system for it and we have to rely on the people to do the “right thing”