You'd be shocked by the gaping holes in policy in a lot of these big corporations. I've seen insane precautions taken to protect all of the "audited" systems while doing stupid things like copying production data (unsanitized) to the dev and test systems that every Tom, Dick and Harry have...