At the 1993 ACSAC conference a previous paper was presented describing the security policy developed for a large, integrated &fence procurement, the United Kingdom Royal Air Force Logistics Information Technology Systems (LITS). The current paper describes some of the practical difficulties encountered in implementing that security policy during subsequent stages of the LITS system development issues discussed include the difficulties of "future proofing" a security infrastructure in the real world where users security requirements can and do change in ways that were not anticipated, the tension between security policy requirements and cost effective security solutions, and the conflict between labelling data and the use of untrusted applications.