It’s not even optional as soon as you’re getting close to any type of standards or compliance framework like SOC2 and the likes.