If you require certification of software by some standard, companies will build software that passes the certification standard. But in my experience, the assu

If you require certification of software by some standard, companies will build software that passes the certification standard. But in my experience, the assumption that a security, quality, or whatever certification process correlates with actually secure, high quality, etc software does not have a lot backing it. There's a big difference between dotting the i's and crossing the t's according to ISO-9001, and actually caring about software quality, and it seems like the standards make it harder to actually care and actually focus on delivering a good product.