Every new security standard can bring another request for the same evidence. ControlCase has built a business around a sensible objection: why collect it twice?