I've done it, it's just drawing up documentation on why controls are satisfied another way and getting auditors to sign off on it. It's such a PITA and CISO li

I've done it, it's just drawing up documentation on why controls are satisfied another way and getting auditors to sign off on it. It's such a PITA and CISO live by not doing anything risky that few teams can get away with it.