Now that I think about this, these policies should probably be stored at the org level per org. We will also need to store the current master passcode policies globally, so that we can compare the various policies if/when required.