The security team picked a security flag that increases risk exposure as it allows for the execution of operating system commands from within SQL queries caused by the XP_CMD_SHELL parameter enabled.
Does the SOI database need XP_CMD_SHELL to be enabled?
SOI 4.2.X
SOI db does not need the XP_CMD_SHELL - it can be safely disabled.