The pain of technical compliance isn't the rules. It's the evidence.

The hard part of technical compliance isn't the controls. It's proving you stayed compliant between scans, with evidence captured at the change.