They're not going to make sure of anything, in my experience, except that an org's IT management had a disappointing conversation with their team and then aspirationally checked boxes claiming to have things in place.