I imagine getting any security best practices (as defined by the employee) implemented to be as much as a political challenge as it is technical.

With that said, most technical people don't want to be politicians.