Agree, it's easier for the company to have a blanket policy. And most companies will do that because, ain't nobody got time for [being overly competent]. But wh

Agree, it's easier for the company to have a blanket policy. And most companies will do that because, ain't nobody got time for [being overly competent]. But what I said was that the actual requirement given to vendors is, in my limited experience, written to apply only for access to customer data. That is, it is the implementation that is overly broad, not the requirement being passed down.