The Consensus Audit Guidelines -- the 20 critical IT security controls unveiled in early 2009 -- may not have been universally adopted by federal agencies, but they're having an impact on government policies toward securing information technology.