A draft policy bans all cloud storage with no exceptions process. What policy-design problem should the governance council flag?
Select an answer to reveal the explanation.
Short Explanation
A 'never ever' cloud ban with no off-ramp is a policy people walk around, not through. Good rules are clear, enforceable, and have a real exceptions path for legitimate needs. Otherwise the unofficial workaround becomes the real standard.
Full Explanation
Unworkable absolute bans without clear exceptions paths tend to be ignored and weaken enforceability of municipal information policy. A draft policy that bans all cloud storage with no exceptions process should be flagged by the governance council as likely to drive shadow IT rather than reduce risk for the city. Insisting absolute bans are always preferable because staff never need flexibility ignores legitimate SaaS, continuity, and partner-exchange use cases cities already run. Banning cloud only after confiscating every laptop is theater, not risk-based information management, and damages operational capacity. Keeping policies unpublished so auditors cannot find them fails transparency and public accountability duties expected of civic institutions. Exam caveat: restrictive defaults can be appropriate for highly sensitive classes if a documented, time-bound exception workflow exists with named approvers and reviews. Operational check: rewrite the policy with classification-based controls, define exception request and review steps, publish it to staff, and sample both enforcement and exception quality quarterly. Security and DG councils should track exception volume and aging so civic flexibility does not become permanent unreviewed risk hiding beside an absolute ban that nobody follows.