That's what happens when you have external security requirements along with audits and incompetent/greedy management. Designing and implementing a security poli

That's what happens when you have external security requirements along with audits and incompetent/greedy management. Designing and implementing a security policy based on the standard is a waste of money when you can do the bare minimum by checking off boxes.