Information security standards focus on the existence of process, not its content

The existence of prescribed security processes in organizations does not mean the goals of the processes are achieved.