This is almost a rule in Europe. The visible part of these organizations (head, management and recommendations) are pitiful or plain outrageous (recommendation

This is almost a rule in Europe. The visible part of these organizations (head, management and recommendations) are pitiful or plain outrageous (recommendations are usually years behind the reality, which contrasts with recent NIST posture). At the same time, the regular folks are usually surprisingly good, open and forward - thinking. They either work in the dark or have propositions which never reach the top. When I say "surprisingly", it is because that are statistically better than their counterparts in the private sector, and are payed way less.