I feel like a lot of companies need to check compliance boxes. We apply CIS benchmarks as part of getting our SOC 2. They're not required explicitly but they're

I feel like a lot of companies need to check compliance boxes. We apply CIS benchmarks as part of getting our SOC 2. They're not required explicitly but they're easy to apply and auditors accept it without any fanfare. I haven't run into any situations where container images need to have CIS benchmarks applied, only VMs.