I don't assume they have no value. And this general sort of decision-making happens all over in companies (and the public sector) all the time. It's not limited

I don't assume they have no value. And this general sort of decision-making happens all over in companies (and the public sector) all the time. It's not limited to any particular department, it's just a little more checklisty and cargo-culty in the security world (and I would expect in HR where it concerns procedures like this). [EDIT] to provide some context, I've come to see a huge portion of decisions about policies, procedures, tools, and more as basically personal and departmental risk mitigation and blame-deflection rather than anything aimed at helping a business function. At a high level that's the goal, but in the details it becomes about making sure there's always something or someone to point a finger at. Conveniently these things don't always need to be directly relevant or useful, so long as something's being done and can be put on a powerpoint slide when the C-suite or someone at some company yours is courting asks a question. As long as "what are we doing about X?" can be answered with "Y and Z, both of which are standard industry practices, see this HBR article about how IBM does it" you're good.