A policy does not exist if you don't build and maintain the systems to effectively follow it.

Multi-billion dollar companies need to be held to higher standards than "we got a piece of paper around here that says we won't do that"