I think it's primarily written to a different audience than yourself, then. I mean that in the best of ways. As an infosec sort, it came across pretty clearly what they intended. I think it's just a culture difference between information security, and the rest of IT.