True, true, true. But how about this: Security auditor: "What's all this data for?" PHB: "I don't know, it's the way it's always been done here." Security au

True, true, true. But how about this: Security auditor: "What's all this data for?" PHB: "I don't know, it's the way it's always been done here." Security auditor: "Your data retention policy doesn't pass ISO27001 (or PCI or whatever). No certification for you. Cyberinsurance company: "We're tripling your rates because you aren't certified." CEO: "PHB, deal with this problem."