The U.S. Federal Government already has [NIST-800-53](https://en.wikipedia.org/wiki/NIST_Special_Publication_800-5...) (for software), and [FedRAMP](https://en.wikipedia.org/wiki/FedRAMP) (for cloud infrastructures). The regulations and certifications are there, it's a matter of implementing them properly in a way that actually ensures real-world security, not just that there's a huge, 200-300 pg. document somewhere describing a secure state of an application.

But this is what OpenControl is meant to solve. https://github.com/opencontrol/