Compliance and certification as a system to establish trust between organisations is totally broken. Now there are some questions, that can't be answered with yes or no, that would reveal the level of cybersecurity maturity. Alas, this is beyond reach or even the imagination of most.