You can often engage people, especially technical people who enjoy things being gameified - by showing them that Qualys gives them a lousy score for what they've done.

https://www.ssllabs.com/ssltest/

Also this lets you out-source the decisions about what's important versus what really doesn't matter to somebody else, and unless you've got (or can hire someone who has got) hours per week to read and digest work in this area that's likely going to mean better security in practice.