We use it as a tool to develop and monitor attestations and assessments where we develop questions based on our policies and ask application owners to explain and show compliance with our policies through a series of attestation questions.
I refer to it often when I'm looking up applications in the CMDB. The CMDB gives me a lot of information on the application in terms of what certain parameters are, who owns the application, and what's the structure of the organization owning the application. It gives me a fair amount of information.
We are using the latest version. We stay up to date with all the patches.