Many senior security managers told us that prior to the recent strengthening of their security programs , their organization 's information security policies had been neglected and out-of-date , thus failing to address significant risks associated with their current interconnected computing environment .
Their information security policies were not up to date .