I agree with you in the sense that those are literally the first thing I would do as a CISO anywhere too. But I've long accepted that this is why you or I will

I agree with you in the sense that those are literally the first thing I would do as a CISO anywhere too. But I've long accepted that this is why you or I will never be CISO of an organisation like this. I've worked alongside such people, and they'd be horrified that thread isn't all about a logon disclaimer on that VPN.