The thing that ISO helps with is not so much requiring "must have access control", but much more the fact that it requires having specific people responsible fo

The thing that ISO helps with is not so much requiring "must have access control", but much more the fact that it requires having specific people responsible for security and having processes to monitor and continuously improve the security practices. It's often frowned upon by engineers, because it's much more about processes and management structure than anything technical. But I've been involved in a few organizations that went from "technically good but unmanaged" to ISO certified. And I'm quite sure all of them got more secure and did more in terms of continuous improvement after certification.