I know. TiSAX (automotive industry requirements standard) forces much of this onto us (just to name one example).

And if I am not mistaken even ISO27001 requires this to be compliant/certified.