External product security policy