Darkreading: compliance

[coley at linus.mitre.org (Steven M. Christey)]

On Tue, 13 Mar 2007, Michael Silk wrote:

> no. my feeling is that it focuses management on unimportant things like
> meeting checkpoints rather then actually doing useful things.

While I understand the sentiment, one thing I don't know is:  how could
you measure "doing useful things" in any repeatable, cost-effective
fashion that does not ultimately boil down to checklists of one form or
another?

- Steve