You don't get to chose in most sizable organizations. Control and compliance are the terms IT/infosec will use to justify their painful requirements.