The first few are password protected screensavers, blocking IM. These bastards are going balistic and we haven't even done the major changes yet like expiring passwords every 60 days
Well, you should have been doing all that years ago, from a security rather than a legislation compliance, viewpoint...............I cannot think of anywhere I have worked in the last 10 years where it wasn't the case. If any of your "experts" bother to talk to anyone they know who works in a reasonably professional environment, I am sure they will find that it is the case.

Where you do things to comply with the law, they have no argument at all................tell them to lobby their political representatives who passed the laws.