[bostik]

> The thing is that real security isn't something that a checklist can guarantee.

I've taken this even further. You cannot do security with a checklist. Trying to do so will inevitably lead to bad outcomes.

Couple of years back I finally figured out how to dress this in a suitably snarky soundbite: doing security with a spreadsheet is like trying to estimate the health of a leper colony by their number of remaining limbs.