When security rules fail in practice

The greatest absurdity: a rule detached from risk

Information security should protect processes, data and continuity rather than produce prohibitions without purpose. A rule becomes absurd when nobody can name the risk scenario, owner, method of operation and evidence of effectiveness. Employees then create workarounds while the organisation gains a document instead of protection.

Examples worth spotting immediately

The point is not to mock caution, but to remove controls that are superficial or increase another risk.

• A secure tool is prohibited while the same data may be sent through ordinary email.
• A shared account remains “for convenience” despite a formal strong-password and accountability policy.
• Backups run regularly, but nobody has checked whether data can be restored or how long recovery takes.
• Contact with the company is blocked in the name of privacy although a lawful controlled form is available.
• Every minor change needs approval while administrator privileges remain uncontrolled.

Security mistakes that appear harmless

The most dangerous absurdities are often routine and cause no alarm until an incident occurs.

• Former employees still have active accounts because IT is not told when their employment ends.
• Updates are postponed without a deadline, exception or risk assessment.
• A cloud document has a public link although the parent folder appears private.
• Alerts arrive in a mailbox nobody monitors outside office hours.
• A worker bypasses the process because the safe route is slower or effectively unavailable.

How to test whether a control is real

The process owner should answer four questions without relying only on the policy wording.

• Which concrete risk scenario the control addresses.
• Who performs it, who approves an exception and who reacts when it fails.
• Which evidence proves that it operated during the latest period.
• What happens after a change in system, supplier, law or working model.

What to check before writing another policy

A new policy should follow the map of data, processes and accountability. Otherwise it repeats contradictions and creates further workarounds.

Security and the ability to contact the company

Privacy law does not require hiding a phone number or preventing clients from contacting the company safely. Define purpose, data scope, legal basis, retention and authorised handlers. A controlled form, restricted mailbox and clear notice can protect data better than informal contact through a personal messenger.

How to turn an absurdity into a working control

Correction begins with the risk scenario and ends with a test in the real process.

• Name the protected asset, threat, vulnerability and possible business impact.
• Choose a control proportionate to risk and team capability.
• Assign owner, operator, deadline, exception and escalation route.
• Define evidence, metric and the condition that triggers improvement.
• Test the rule with a user, administrator and process-accountability owner.

How to secure information in the company

A coherent protection system combines people, technology and management decisions instead of multiplying separate bans.

• Classify data and assign owners, retention and permitted channels.
• Use least privilege, MFA, segmentation, patching and secure remote access.
• Monitor events, backup, capacity, privileged accounts and critical services.
• Exercise incident response, recovery and communication with users and clients.
• Review controls after incidents or changes in systems, suppliers, processes or law.

Owners, exceptions and accountability

An exception is not a control failure when it is visible, limited and regularly assessed.

• Every control has a business owner and a person accountable for execution.
• An exception records reason, scope, risk, compensating safeguard and expiry date.
• A missed decision deadline escalates to someone authorised to accept risk.
• The exception register is reviewed alongside incidents, changes and audit findings.

Example: replacing a shared account

Banning shared passwords does not solve the problem if staff still need the same mailbox or application. First provide a way to work without sharing a login.

• Check who uses the shared account and why, including holiday cover and work outside office hours.
• Provide individual access or delegated permissions to the shared mailbox. Check with users that they can complete their tasks.
• Once the new access works, disable the shared login. Assign responsibility for removing permissions when someone changes role or leaves.

When to request an external review

Independent assessment is most useful when internal disagreement blocks a decision or a control lacks credible evidence.

• IT, compliance, legal and business teams interpret the same rule differently.
• Audit reports missing evidence despite numerous documents and procedures.
• Employees regularly bypass a safeguard to complete their work.
• Incidents recur although the control is formally marked as implemented.
• A change in cloud, supplier, working model or regulation requires reassessment.

How to write instructions people can use

Staff need to know when a rule applies, how to complete the task and whom to contact if the instructions do not work. A policy name or procedure number alone is not enough.

• Purpose and risk scenario in plain language.
• Scope of data, systems, roles and situations where the control applies.
• Owner, frequency, execution steps, exceptions and escalation.
• A way to check the result, such as trying to log in after access is revoked or restoring a selected file.

What separates a real control from a paper control in 2026

Review records, test results and owner decisions can demonstrate that a control operates. An approved document alone does not show whether it works.

What outcome a controls review should produce

The review should end in decisions rather than another list of general recommendations.

Related Virtline services

Rule clean-up usually combines risk analysis, identity protection, collaboration and technical safeguards.