I’m not justifying anything. I’m just communicating the reality of how security, procurement, and compliance works in the real world.

See the note in the original comment:

> Note: I don’t like that this is how compliance works. I wish compliance were more closely tied to security. But that’s simply not reality.