There’s an almost pleading line near the start of the Consensus Audit Guidelines draft that reveals how its authors hope to grab attention: address the reader as a CISO, CIO or IG and maybe they won’t look away.\n That tactic speaks to a bigger problem in information security: people often work harder to sidestep rules than to follow them. The CAG is an effort to make sensible...