Yeah .. voting around here is interesting from time to time.

On a positive note, I hadn't heard of the Linux Security Audit Project, looks interesting, thank you.

I only briefly skimmed through the readme so I might have missed it, but I wonder how they're able to claim compliance with specific standards.

It was my understanding that it's typically a drawn out expensive process with a certificate to hang on the wall after the fact.