It is the user's responsibility to archive messages. The IT organization will maintain backups of current messages. They will use a card key and a six-digit PIN to log in. The advantage of having three specification levels is that changing particular products or vendors should not generally require changing practices. Additionally, practices that do a better job of carrying out policies can be adopted without high-level policy debates.
Wise organizations encourage broad participation when formulating policies.
Widespread understanding of why policies are the way they are make the derivation of practices from policies smoother and less politicized than would be the case if policies were mandated by a small group of executives or IT staff. Different organizations have various levels of commitment to developing and maintaining documents related to policies, practices, and procedures. Large, distributed enterprises with numerous resources will typically have a greater need than small organizations for documenting uniform policies, practices, and procedures. For educational institutions, spelling out user responsibilities and prescribing consequences for abusive activities might have a high priority. Financial institutions will certainly have strong incentives to explicitly document the steps they take to secure data and prevent tampering.