One thing I've changed my mind about over the past couple of years is asset inventory.

It always felt like another compliance task until we started finding forgotten VMs, old cloud resources, and systems nobody remembered owning.

Turns out "you can't secure what you don't know exists" isn't just a cliché.

What's one compliance requirement you've ended up appreciating more over time?