Two things that I am aware of: (a) All standards provide a "comment period". Along with contact details for those standard bodies, there is a viable mechanism t

Two things that I am aware of: (a) All standards provide a "comment period". Along with contact details for those standard bodies, there is a viable mechanism to some extent. (b) Standards are broad, which makes the language a bit abstract, and this can be a problem. However, they also include "compensating controls", which are typically used as a wedge to avoid a compliance failure. I have had great success with several auditors with a polite conversation trying to help them map their goals to our controls. Yes, you will always meet an auditor or two who won't accept anything but the written word of the standard. Like any other industry, there are smart and dumb auditors. :-)