Comment by yread

I'm in a similar position. The business continuity requirements are difficult to satisfy. And the amount of paperwork you need to do (depending on your policies of course) can be a major slow down for developing new stuff. So it's best to get your dev heavy stuff done before. I'm just filling in the questionnaires instead for now (and losing some customers who would be too big anyway)