People need to admit one can't protect systems from the unknown. Thus, detection and incident handling is arguably more important. If CISCO/Google/Amazon/Micro

People need to admit one can't protect systems from the unknown. Thus, detection and incident handling is arguably more important. If CISCO/Google/Amazon/Microsoft can't keep their systems clean, than you can be certain adversaries who feign ignorance will be much worse regardless of the paperwork. A certification program similar to EMC testing in labs would however be favorable, as it does not consolidate the attack surfaces. Additionally, it allows the test to evolve with emerging threat vectors. If you think companies will let people poke around their security policies for paperwork stamps, than you are fooling yourselves. Good luck, =)