In Germany we had something like this from the TUEV Süd, where they certified online shops and online banking websites for their security. Suffice it to say, b

In Germany we had something like this from the TUEV Süd, where they certified online shops and online banking websites for their security. Suffice it to say, but the keywords are a google dork for finding easy to hack pentesting victims. Now the BSI (German institute for cybersecurity, similar to CISA) also started to push out certifications for the BSI Grundschutz, which is an absolute meaningless certificate and literally tests the absolute bare minimum things. The problem here is that there is no market, this cyber security crisis cannot be solved economically, because customers want a certificate without having to do further work. So they'll get it at whatever auditor that accepts their money. This is how it's done, even for ISO 27001 and SOC2 certifications. Nobody gives a damn if a single working student has 20+ role descriptions laying on their table. Findings are always ignored and never corrected. Cyber security policies and their effects over time need to be measurable first before there can be certification processes. Additionally there needs to be legislation that cannot be interpreted. Things like "reasonably modern" cannot be used as a law text because it doesn't mean anything, and instead standardized practices have to be made mandatory requirements. Preferably by a committee that is not self controlling, maybe even something like the EFF, FSF, OWASP or Linux foundation.