I disagree with Jacob Horne on how much shoudl get “tailored” back in.

171 is a standard and not a framework. You have to embed it into your risk based secuity plan.