This document proposes building a scorecard for evaluating security management and control frameworks. It discusses issues with existing frameworks becoming checklists over time and proposes a rational way to judge frameworks based on factors like efficacy, completeness, robustness, and cost for organizations of different sizes. The document shares initial reactions to frameworks like ISO 27002 and PCI-DSS. It aims to prioritize effort, allow split-horizon assessment/audit, and end "Legislation Amateur Hour" through conscious design of security frameworks. The author questions if they have proposed something better for governance, risk, and compliance (GRC) or gone too far.

4. Framework Scorecard $$$$$ Small, Medium, Large Organizations

5. Framework Scorecard $$$$$ Small, Medium, Large Organizations Efficacy Tactical/Technical Patch and Vulnerability

6. Framework Scorecard $$$$$ Small, Medium, Large Organizations Efficacy Tactical/Technical Patch and Vulnerability Completeness Sustainable Program

7. Framework Scorecard $$$$$ Small, Medium, Large Organizations Efficacy Tactical/Technical Patch and Vulnerability Completeness Sustainable Program ?Robustness? Shelfware-Resistance Low-Maintenance Atomicity v/s Dependence

8. SWAG Reactions: ISO 27002 $$ Reasonably large Some Guidelines Reasonably Complete OK Robust, some audit burden and rework

9. SWAG Reactions: PCI-DSS Relatively Small Mostly Tactical Bollocks for Sustainable Has “Policy” Robustness as a function of small size

10. SWAG Reactions: NIST RMF Much Cost Prescribed but not the focus due to abstraction The Whole Hawg of Completeness Horribly fragile, this adds significantly to the cost