If an org has that kind of risk, shouldn't they be paying for their OS?