I used to work in the ecommerce space.. along with PCI our security/compliance people made us do lots of vague things with our delivery pipeline with the broad excuse of "SOX compliance"

When asked for the specific rule we had to follow, there was never any response.