Is there a written and approved security policy?

If there is one, verify if they've followed the rules.