We work in Sweden, Denmark, Poland and The Netherlands (and Germany until April ). You have to adapt to these situations. For example Poland has been under the Iron curtain for decades. That's not something you can change easily. So you adapt to get the best success. Something a attacker would also do, adapt their tactics in a phishing campaign.
Although is sometime about overcoming a problem and create 3 procedures to one Information Security Policy just to get to differences in. Not the most efficient way but it's the effect that counts.
