2 ms·

How does that differ from choice #1, 'The reasons a policy was put in place. ("Why did we do this?")'? A policy's expected outcome is correlated with why a pol

• the8472 6y ago
  A policy might be put into place because a single event. The expected outcome can drastically differ depending on who writes the policy. E.g. it could be "this type of attack won't succeed again" vs. "even if this or a similar kind of attack succeeds it won't expose our entire data"
  • IncRnd 6y ago
    That's my exact point. A policy isn't random but created for an effect. As an examnple: If an HN disclosure leaks passwords and email addresses into the public domain, imposing a policy control is _meant_ to have the effect that such a disclosure would not happen again, or if it does to have a limited scope.