Compliance is one thing but a cybersecurity incident response team is very blind without an EDR not to mention you would have less protection from insider threat.