Agree I think - the most common mistake people make is just not doing the work. The work means: Understanding the regulatory framework for your ecosystem (and

Agree I think - the most common mistake people make is just not doing the work. The work means: Understanding the regulatory framework for your ecosystem (and partners), and maintaining policies that align with those requirements. Ensuring that system owners understand the policies, and that they document how they meet the requirements. Ensuring that actual behaviour corresponds to the design and keeping an eye out for errors (if you haven't had to scrub your centralised logging yet you should probably be looking harder...). The intent is not primarily to sweat every detail but to limit gross violations and make sure you're not asleep at the wheel (which is common) or behaving badly. What audits want is evidence you're "doing the work". Be able to clearly explain what you do and why you think it complies. Be able to prove what you say. The details tend get hashed out as a result of following a process. The real-world problems people tend to have are more like "we don't know why we copied all our customer information to that bucket" or "hmm they might have onsold it" or "we don't actually know all the systems that read from this database or what they might copying out it" than "we are concerned about advanced storage necromancy".