https://www.nsa.gov/What-We-Do/Cybersecurity/Advisories-Technical-Guidance/ https://www.nsa.gov/What-We-Do/Cybersecurity/Advisories-Tech... The NSA seems to ag

https://www.nsa.gov/What-We-Do/Cybersecurity/Advisories-Technical-Guidance/ https://www.nsa.gov/What-We-Do/Cybersecurity/Advisories-Tech... The NSA seems to agree with you. So do the Departments of Energy, Commerce, and Defense, all of which have various efforts to provide independently verifiable high quality security advice, best practices, and guidance. In some cases, they've been doing so for years. But let's skip the NSA bit. Let's say you, CEO of Big Pipeline Co, have been called up by someone at The Office of Cybersecurity, Energy Security, and Emergency Response within the Department of Energy. They offer you all the advice and guidance you could wish for. Now it's up to you to budget resources. What do you do? Realistically, you probably hand that advice off to your IT or software staff and hope for the best. Though I realize that reasonable people may differ on this point.