[caseyy]

Yes, it does become complicated when the management are the laziest. The average worker will do what they are asked to for information security.