As 53 got revised they took out the “implementation” and “prioritization” to make 53 more “flexible” We should tell companies, “you can save money on a lot of controls that aren’t technical”