#1 problem with this is that it is based on policy language, not actual measured behavior. Behavior is hard to measure, but especially in this area, where lying is both common and sometimes required by law, policy wording isn't so meaningful.

For example, it doesn't include a measure of security against government hackers, or internal "hackers" doing govt bidding.