Corporate security requirements usually seem to come down to some committee sitting down and looking at every available option and demanding that they be configured to the most secure looking option, without regards to how much it actually improves security.

This is a continual frustration of mine, when valuable diagnostic data is disabled for security reasons and then when stuff breaks I'm asked to go fix it blind. Sure you can have gigabytes of audit logs that are impossible to find anything in, but an error message that tells you that some system certificate expired is too much of a security vulnerability.