Exactly. It's wonderful that there's a few thousand controls for things like password length. But things that cause massive security nightmares like "does the C

Exactly. It's wonderful that there's a few thousand controls for things like password length. But things that cause massive security nightmares like "does the CTO care about security?" or "has a pentest team reviewed and audited the source?" are so fundamental and should be triggered as any new system touches more and more systems. "Does this software touch literally every other system on the network?" should be a question that triggers a much more rigorous and deeply technical evaluation and review. But the current processes don't work that way, they purely paperwork drills that often demonstrably make systems less safe.