Can you tell us the full story?

That's pretty much the story. It came in as a high priority issue with no context. I asked for clarification, he asked if we wanted to fail the the audit. I changed them to red and he wrote a thing about we were more secure now.

I've worked in a datacenter that had a few different networks that must not touch each other. One of the precautions we took was color coded ethernet cables. A blue cable plugged into a red server will cause an incident if someone sees it; even if the other end is another red server 1U down.

Honestly, that seems clever, I like it!

This was a common practice in the military for secure and insecure feeds. I also saw this practice in telco.

Yeah you don't even have to get silly before you reach impossible.

One client's compliance jobsworth demanded a tour of our datacentre (AWS) to inspect physical security for low grade employee PII (email, name). I was younger and poorer then so bent over backwards to still get told "er, no thank you" from Amazon.

Client's security weren't happy with third party security certifications (of which AWS has most) so they reported up that we were likely hiding something devious. I think they'd had some sort of physical breach in the past but it just makes using an external service supplier untenable if you're going to treat security like it's 1970. I think we still got that contract but it took high-level meetings to ELI5 modern infrastructure's features and limitations.

We've had others rock up at third sales meetings (pretty advanced) saying they now "need" source and data design before they sign. One asked me to get a criminal record check. To reiterate, we're storing light employee data and everybody knows and understands that, but some people just seem to treat all data exchange as nuclear waste.