Sure -- if we also discipline IT when their policies fail to meet business needs, because they ultimately serve the business, not themselves.

It's really easy to secure / fix / support a system by making it nonfunctional and redefining that as success.