Comment by tass

Compliance was the reasoning they raised, yes.

Whether you require this particular tool to meet compliance, and whether that tool needs to be deployed across the entire stack might be open to interpretation though.