Ironically, things done for PCI&#x2F;ISO27K compliance very often decrease security. Maybe not always, maybe not everywhere, but at least that&#x27;s my experience with the companies I worked at and is also in line with the stories I heard about other companies.<p>Quite recently: Security was concerned about enforcing ssh key rotation and was pushing for sysops to generate and store (obviously - unencrypted) private keys for all users on a central jump host and provide users access to that host using passwords (for which enforcing lifecycle policies is easier).