I wholeheartedly agree with you, with the only exception of Risk Assessment/Risk Management approach, as I don't think it brings the benefits that most expect. Have you looked into Evidence based cybersecurity management?