anchor: Many senior security managers told us that prior to the recent strengthening of their security programs, their organization's information security policies had been neglected and out-of-date, thus failing to address significant risks associated with their current interconnected computing environment.
positive: Their information security policies were not up to date.
negative: Tgheir information security policies were up to date and working fine.