Summary
This article argues that security policy should be considered critical infrastructure, particularly in regulated sectors like banking and utilities. It highlights how misconfigurations can lead to severe operational risks and discusses increasing UK regulatory expectations for managing these policies with infrastructure-grade discipline.