Yes? At least in my experience as a service provider. With cloud I can easily plug in a compliance vendor like Drata, add connectors to my other vendors, and

Yes? At least in my experience as a service provider. With cloud I can easily plug in a compliance vendor like Drata, add connectors to my other vendors, and get a significant amount of evidence quickly. Bespoke on-prem solutions bring plenty of their own challenges that are just N/A or handled by cloud vendors, like physical security. Maybe as a payment processor things shake out differently. Though having read far more of PCI v4 than I'd like, I doubt it.