Like most security regimes, it's both overly prescriptive and woefully insufficient. In short, dumb. :(