Yes, good points. On the other hand, it makes things easier to point to a standard in lieu of answering security surveys with hundreds of questions, not always

Yes, good points. On the other hand, it makes things easier to point to a standard in lieu of answering security surveys with hundreds of questions, not always the same, from different prospective clients on a weekly basis. A certified standard would streamline this process. But, maybe that's why organizations each have their own survey in order to really gauge how well the org cares about security.