anchor: The security officers at the computer vendor said that because the company's information security policies emphasized user behavior, they were included in the organization's employee code of conduct.
positive: The company's security policies are included in the employee code of conduct.
negative: The company's security policies are difficult to find.