> Is it a bureaucracy certification with some vintage requirements or is it something that keeps adapting to the changes in the technology environment? That's

> Is it a bureaucracy certification with some vintage requirements or is it something that keeps adapting to the changes in the technology environment? That's not really an "or" question. It is a bureaucracy-oriented standard that focuses mostly on whether you have the right policies in place in all the right topic areas. But it also adapts reasonably well to changing technology -- because it actually has relatively little to say about specific technologies.