[waihtis]

> By a wide margin, their most impactful designed purpose is to sell security products and services

The cyber causality dilemma - which came first, the vendor or the framework?

I think there's some use for the framework to make people think about which controls and concepts might work for a given situation, but certainly they need the real world to be examined in parallel to be useful