I think that it might more have legal implications than practical ones. It wont protect the organization from information exfiltration, but it might legally pro

I think that it might more have legal implications than practical ones. It wont protect the organization from information exfiltration, but it might legally protect it, in the sense that a court might state that the necessary technical measures were there, so the organization is not responsible for the data leak that happened... or something in that direction.