Security policy oversight needed?