Security assessment

Is compliance(ISO, PCI) enough? Or should we also have a security assessment done to understand our security posture ?

Im trying to look for ways to improve security posture for my company but have no idea if I should propose conducting a security assessment to understand overall company security maturity when we already do compliance. Will this add unnecessary burden to the team ?

assessment cybersecurity security security assessment