>and yet again and again, companies say "just give us something meaningless and arbitrary, so we can say we're compliant". Because something meaningless and ar

>and yet again and again, companies say "just give us something meaningless and arbitrary, so we can say we're compliant". Because something meaningless and arbitrary is something companies can point to and say "we're compliant", and absolutely no one can question them or say differently, that's why. As long as they're compliant with the arbitrary standard, you can't just sue them for being non-compliant, even if the standard is crap. Whereas if they make a good-faith effort but there's no standard in place, then someone can argue that in front of a jury of 12 morons that it isn't good enough, that they didn't really do it, etc. The crappy standard removes the element of differences of opinion.