The devil is all in how one defines "properly". I've seen a bit of what passes for bureaucratically defined security policy and I'm not impressed. It is largely

The devil is all in how one defines "properly". I've seen a bit of what passes for bureaucratically defined security policy and I'm not impressed. It is largely an exercise in checking boxes for liability reasons and nothing more.