It's unclear what level of analysis is being done beforehand to determine appropriate levels of security for particular systems. In most businesses, it's a waste of resources to protect every system to the maximum extent possible. Some systems just aren't that mission-critical. Richard Hunter