This. CYA by ticking the boxes. We once had a city IT guy block our deployment because we were vulnerable to CVE-whatever - turned out to be a minir vulnerabil

This. CYA by ticking the boxes. We once had a city IT guy block our deployment because we were vulnerable to CVE-whatever - turned out to be a minir vulnerability in the DuckDuckGo browser