> when their standard requirements are 15 years out of date

I swear half of my "compensating control" responses are just extended versions of "policy requirement is outdated or was always bad".