You'd be surprised. Any organization regulated by federal government entities, such as banks via the OCC, FDIC, etc are being required to "meet" CISA guidelines. ESPECIALLY those with federal/military contracts.
CISA has a lot more sway than you'd think in how businesses operate from a security point of view.
Being this broad allows for some more latitude by the businesses / sectors following these guidelines. But they certainly could've been more thorough in their approach without much push back.
When asked by a reporter whether the Pentagon had ruled out aliens or extraterrestrials, VanHerck said no.
"I haven't ruled out anything at this point," he replied. "We continue to assess every threat or potential threat unknown that approaches North America with an attempt to identify it."
CISA has a lot more sway than you'd think in how businesses operate from a security point of view.
Being this broad allows for some more latitude by the businesses / sectors following these guidelines. But they certainly could've been more thorough in their approach without much push back.