I've come across this with data security policies at law firms, accountants, and investment banks.

They have to protect sensitive client data. Need to protect against illegitimate leaks of data. And the universal way that they communicate with clients, opposing parties, regulators? Email.

You can't force the SEC to accept your new encrypted cloud solution, nor can you require opposing counsel to use YOUR solution. And communicating with hostile parties is the entire organization's reason for existing.

"Simple and reasonable" IT approaches to problems frequently break down when faced with people whose job it is to deal with other organizations.