I have been responsible for these controls in multiple startup and smaller businesses selling into Fortune 500, including setting up security "programs", and ag

I have been responsible for these controls in multiple startup and smaller businesses selling into Fortune 500, including setting up security "programs", and agree with everything you say. Ultimately it boils down to: > Convince whoever is asking you are following whatever process they are asking about so they can check a box. They call it security theatre for a reason. Of course if you don't want to be lying, well, you gotta implement a lot of this stuff as at least written policies. Also, auditors have a tendency to ask for evidence...