Policies are inadequate for providing blanket coverage of all scenarios.
She said that her central security group had recognized that policies, no matter how detailed, could never address every scenario that might lead to a security incident.