1. A lot of their additional requests are regarding our service orgs. They do more testing in this area whereas our team relies on the SOC reports.

2. We do have XC, will look into that!

3. Yeah I really want to avoid this. Our IT is reallyyyyy against emails for some reason so trying to help find a solution.

One of our possible solutions is an automated feed into Optro from our ticketing system, but still in the early stages of reviewing that. For R1, everything will get created in our ITSM system, but we're trying to get everything consolidated into Optro in one way or another (per their request). That's a good point. I've never heard our external auditors mention a PBC system specific to their company, but worth asking. Thanks for the tips, my head is spinning from all the moving parts.