The Payment Card Industry Data Security Standard is widely used in the financial industry and seems to be a useful requirement from the standpoint of a potential customer (see also Does PCI compliance really reduce risk and improve security?). But as noted at Is PCI DSS applicable to other solutions than those dealing with payment cards? it is focused on protecting things like credit card numbers ("primary account numbers").
Are there standards and related server certifications that are more suitable for e.g. web sites that hold a variety of sensitive personal information that is not financial (e.g. social networking sites), or government or military sites, or sites that run private or public elections?
Update: To clarify, I know lots of other questions on this site address more general guideline lists which are useful to IT departments and developers when they address the security of their own sites, and I'm not looking for more of those. I'm asking this question from the viewpoint of an outsider - a potential customer, relying party or partner of a web site, and I'm looking for standards which the customer could require compliance to. Ideally the standard would come with some relatively formal notion of who is qualified to judge compliance with it. And I'm wondering if requiring PCI-DSS would be appropriate for any of the kinds of web sites I mention, assuming that they don't actually handle any financial "primary account numbers".
I'm also sympathetic to the sentiment that the answer may just be "No" - that efforts to establish certifiable rules for a general case are just taking the wrong approach, and that such standards only make sense for certain very specific types of sites. Pointers to evidence or well though-out opinions of that sort would be helpful in that case.