There is no national directive which requires my clients to engage in systematic procedures to deny adversaries either information or advantage. This is not to say that it isn't done, merely a statement about its regularity. I'm usually called in after a problem has occurred or when the perceived threat is intolerable. In many cases, top management views my role, and security in general, as a reactive process, and often as an inconvenience. The security problem is rarely viewed from a long term perspective and solutions are expected to be swift, specific, and spectacular.
Many good ideas dissipate in the vaporescence of fleeting management support.
The security trend in the private sector for the last few years has been generally negative, reflecting the aftermath of a deep recession, corporate downsizing and restructuring, and, to some degree, a perceived reduction in threat due to the breakup of the former Soviet Union. Whatever the blame, security and training were immediate corporate casualties. Corporate America remains basically reactive, waiting for the next incident and hoping that in-house security projects will protect them or, if the worst thing were to happen, that someone has hidden a disaster plan to stabilize the situation. The private sector is not alone in its reluctance or failure to properly emphasize information security and employee safety. As previously noted, this usually signifies a lack of concern by upper management.