Win2k, etc other servers out there also. Therefore, the policy must be broad enough and flexible enough to account for these variations in the environment of the public Internet. Yes, I am. They ARE vendor specific. I question the validity of the numbers you indicate.
Sometime policies have to be firm.
JUst because a company the size of MicroSoft sells a LOT of widgets, doesn't mean we should change the rules to make the implementation of the MicroSoft widget easier. I think it is erroneous to hold policies to vendor-specific limitations. Protocol support should be the primary focus for policy. I mean no disrespect but that is not current possible in IIS 4 or IIS 5.o. 4 or 5 use SSL with the same IP, IIS blocks it with an error message.