The vendor will never tell you to simplify your security policy, in fact, they love complex security rules and winding implementation projects.

FORBES: Why You Cannot Rely on Vendors for Your IT Strategy

For instance, a database administrator can mistakenly implement a security policy that affects all of users of the service but actually contravenes the policies or rules that some customers need to abide by (due to above-mentioned national or industry rules).

FORBES: Multitenancy & Cloud Computing Platforms: Four Big Problems

Still, the introduction of such provisions has been fairly widespread, even beyond Wall Street, with Dodd Frank regulations requiring the SEC to adopt rules that prohibit companies from listing on the national security exchanges if they fail to implement a clawback policy on incentive-based compensation.

FORBES: Bankers Will Still Get Their Billions Despite Clawbacks