The last time this got discussed, I thought the consensus was he was trolling -- the point being the correct answer is to explain why you don't have these (tech

The last time this got discussed, I thought the consensus was he was trolling -- the point being the correct answer is to explain why you don't have these (technical controls, hashing of passwords, etc.). The other reason would have been if he wanted login access to servers to validate configs himself, but there are much better ways to accomplish that (I'd be very reluctant to give an auditor anything but read-only access to any production infrastructure, but it is valid to want to know that what is being given to you matches production; there are ways to accomplish both).