No one in IT wants to deal with that stuff. Upper management requires it for compliance and cyber insurance.