Guidelines and tools designed to help organizations strengthen their cyber posture will be rendered useless if rules aren’t in place to ensure such practices are adopted.