To identify vulnerabilities that can only be exploited through social engineering.

To provide a comprehensive security standard suitable for most web applications.

To focus exclusively on cryptographic controls for high-risk applications.

To establish a baseline security standard for applications without sensitive data.