The NIST guidelines are among the most competent from a government source that exist in my opinion. A practical issue is that even if we legislated those guidel

The NIST guidelines are among the most competent from a government source that exist in my opinion. A practical issue is that even if we legislated those guidelines, many other national governments demand compliance with their own published guidelines which often directly contradict NIST. This creates challenges for companies that operate in multiple countries. I’ve seen the situation multiple times where “security requirements” that span borders were mutually exclusive yet are mandated on both sides of the border. It is impossible to comply yet compliance is expected. Fortunately, the audits are purely superficial; you do your best to comply with whichever bureaucracy is fussiest and no one looks too closely. This is a suboptimal outcome on many levels. Trying to harmonize these contradictory requirements through an international treaty organization like ISO would produce something so watered down as to be pointless theater. I would generally endorse the NIST guidelines as a standard. Unfortunately, many other countries reject that standard and require you to comply with some other guidelines to do business in their country. This is a problem.