Stephen worked closely with the security team to design a policy architecture capable of simplifying and streamlining where possible — while preserving complexity where justified by legitimate business rationale. The first challenge was structural. A global enterprise of this scale couldn't be governed by a single uniform policy mandate — local entities needed independence and flexibility to operate effectively within their specific contexts. Stephen’s solution was a two-tier framework: a set of global minimum guidelines establishing a consistent floor across the enterprise, and a parallel set of locally-driven policies preserving flexibility above it. The global tier set the standard. The local tier gave individual entities the room they needed to manage their own risk environment without breaking from the whole. The second challenge was scope. Security policy in a large enterprise doesn't belong exclusively to the security team — obligations flow in from HR, Legal, Compliance, Facilities, and other functions, each owning pieces of the policy landscape that security personnel had to follow. Stephen mapped those cross-functional policies into the framework with explicit ownership attribution — giving the security team a complete picture of their obligations without overstating their authority or creating confusion about who owned what.