It allowed senior management to emphasize the most important elements of information security policy , provided some flexibility to unit managers , made policies easier for employees to understand , and , in some cases , reduced the amount of formal review needed to finalize updated policies .
Policies still go through a long process in order to be updated .