Many senior security managers told us that prior to the recent strengthening of their security programs, their organization's information security policies had been neglected and out-of-date, thus failing to address significant risks associated with their current interconnected computing environment.
Their information security policies were not up to date.
Tgheir information security policies were up to date and working fine.