I wouldn't make the perfect the enemy of the good. It could start off with just a checklist of common vulnerability types and go from there. The root cause of t

I wouldn't make the perfect the enemy of the good. It could start off with just a checklist of common vulnerability types and go from there. The root cause of these issues is that no one cared about them at all. Just the idea that a certifying agency you are going through anyway will be checking would help enormously.