Do that and you are just creating targets for the next security auditor that you need any sort of certification or approval from.

In the end you'll choose the path of least resistance, which is to slavishly obey every rule on the checklist. It's not that people don't want to tailor the rules. They try at first, and then it gets beaten out of them.

Frustrating indeed.

It's doable sometimes when there's a tailoring framework. Here's a publicly available example [1]. Though I admit that it's usually easier to do in the US than in the European Union, so your experience may vary.

[1] https://www.nasa.gov/seh/3-11_tailoring_and_customization

I suppose I'm not surprised that this breakdown exists, I just didn't know it existed. Thank you for sharing.