Comment by shortrounddev2

I'm certain there are good firms out there which will actually give you a legit audit and make recommendations. But if the client is not actually interested in security, there will always be unscrupulous firms who will essentially sell you an ISO cert for no effort required. In my experience, most medium to small sized companies place little value in security