Making whatever constraints you are putting in place meaningful and make sense is paramount. Educating the customers why this is the way it is should be a must. Then making those security constraints work well is key. If the constraints are horrible or don’t work, people will find a way to get around them. Just ask some in the medical profession. PII or HIPA data are two things that are normally heavily regulated and locked down. I’ve seen people purposely defeat those file restrictions to put them on mobile devices for portability. Changing file names, screen shots, etc. Where there is a will there will be a way.

Mentioning cyber security and data protection in the same sentence with abbreviations or circumvention is problematic. From my own experience, I know that the restrictions that the aforementioned security measures entail do not lead to jubilant celebrations. The only reasonably feasible way I know of is to involve the entire workforce in the run-up to the introduction and to explain in detail why this or that security measure is necessary and how it will change your daily routine and perhaps even make it easier.