We can tell how good these cybersecurity frameworks are by seeing how hard it is to breach the organizations certified at the highest levels such as SolarWinds

We can tell how good these cybersecurity frameworks are by seeing how hard it is to breach the organizations certified at the highest levels such as SolarWinds [1], Equifax [2], Trend Micro [3][4], Cisco [5], and so many more. It is so utterly ridiculous that anybody cares about these standards when literal clown shows get full marks. The sign of a good standard is one that effectively and accurately predicts outcomes. A standard can be validated experimentally by evaluating if the certified targets conform to the stated predictions of the standard. A standard that fails to discriminate between good and bad is useless and the results of such certifications can be safely ignored. The vast majority of cybersecurity frameworks have failed in these respects. Basically, if a standard gives Microsoft top marks, it is a lousy standard. That is not a necessary condition, but it is certainly sufficient along with anything certifying plenty of other security messes. [1] https://www.schellman.com/certificate-directory?certificateNumber=1985896-2 https://www.schellman.com/certificate-directory?certificateN... [2] https://www.oxebridge.com/emma/equifax-held-iso-27001-certification-at-time-of-massive-system-hack/ https://www.oxebridge.com/emma/equifax-held-iso-27001-certif... [3] https://www.bleepingcomputer.com/news/security/trend-micro-fixes-bug-chinese-hackers-exploited-for-espionage/amp/ https://www.bleepingcomputer.com/news/security/trend-micro-f... [4] https://www.trendmicro.com/en_us/about/trust-center/compliance.html https://www.trendmicro.com/en_us/about/trust-center/complian... [5] https://blogs.cisco.com/tag/iso-27001-certification https://blogs.cisco.com/tag/iso-27001-certification