Big companies have big bureaucracies and third-party auditors that define stuff like this. Getting them to change their requirements is a herculean task.