It never stops, but at least with evidence of audits, evidence of pen tests, and policy documentation, it can be a little easier!