This situation could be mitigated if companies had qualified, independent, and adequately resourced boards; however, as I noted previously, this is all too often not the case.
Too often companies don't have qualified, adequately resourced boards.
Under the requirements of the Computer Security Act, NIST is responsible for establishing standards for federal computer systems that process sensitive but unclassified information.