Another thing to keep in mind is that a lot of these lists are compliance-driven.

   - Hosts which process credit cards (PCI)
   - Hosts which reconcile the general ledger (SOX)
   - Hosts with medical data (HIPAA)
   - Hosts with student data (FERPA)

The problem is that while the security of the enumerated hosts is taken quite seriously, systems which have security trust relationships which grant access to the enumerated hosts are not locked down.

   - PCI Payment Processing Application server: locked down.
   - CI system with deployment keys to said host: zero authentication.