In principle yes. The implementation however is rarely defined (if you have examples, feel free to share). In my experience it's by choice that companies use co

In principle yes. The implementation however is rarely defined (if you have examples, feel free to share). In my experience it's by choice that companies use compliance to turn their dev environments into a micromanaged hell that engineers hate working in (our company went through multiple compliance certifications including SOC1 and SOC2).