Typical. Government organizations think IT security means having strongly worded statements and reams of bureaucratic rules and procedures. If you look closely though the strong words often aren't backed by any meaningful action. In a government official's mind if the 50 page IT security document was filled out and is on file that means the system is secure. It's all a big joke really.