[rantingdemon]

We use NIST as a baseline. Some organisations actually try to do this properly :)