My company has to approve all software on the development network. Getting newish versions of boost is bad enough. But keeping something like tokio or even simd

My company has to approve all software on the development network. Getting newish versions of boost is bad enough. But keeping something like tokio or even simd and all its dependencies approved and in sync and then transferring them to the air gapped dev network is just this side of impossible. Is my company an outlier or is this common in bigcorp?