It allowed senior management to emphasize the most important elements of information security policy, provided some flexibility to unit managers, made policies easier for employees to understand, and, in some cases, reduced the amount of formal review needed to finalize updated policies.