XP??? Jesus Fucksticks. My regulatory requirements must be much, much, much stronger than everyone elses. I was forced off of XP years ago and if any instances were found on our entire network (1200ish endpoints) we'd be in violation of several federal agencies. We have one vendor out of thousands that insists on XP and that single machine is 100% standalone with absolutely no networking/internet of any kind.
I am currently getting grief because I have two servers running SQL 2012 V3 which has only been out of support for a few months. I have a single VM server running 2003 that is only retained for retention requirements and it remains in perpetually powered down state, completely partitioned away from the entire network, and removed from the domain with only a single local user.
My favorite part is that the agencies that audit me are the biggest violators of their own rules.