I have tried to point out that poorly implemented or non contructive security controls reduce system availability. As employes are not able to get to the information they need in a timely manner.

But it's been a dead end to many an argument. For some the underlying issue is a refusal to accept that product usability and security are not mutually exclusive and a difficult to use system just leeds to grey IT in the org.

The most odd reply I have received was pedantics on the definition of security availability, i.e.,

"Ensuring data and network resources are accessible to authorized users when needed"

Beacause it contains the word "authorized" any controls for authorisation can therefore never affect availability as they have to be authorized before we can consitter it an impediment to availability...

If anyone has a reply better than that's ridiculous, please help me here