One of the exploitable mechanics of this scheme is the strategic division of labor between organizations who implement the controls, create the security documentation, and provide the sign-off. Generally, each side distributes their risk by involving others who they can blame when things go wrong. It is intentionally designed so that everyone involved, including the "cyber security experts", each have only a narrow view and must trust the others to do the right thing. Risk management is very much a broken game designed to please suits whose priorities are not real cyber security.