Using monitoring to enforce security policies

  How can an organization use monitoring to enforce security policies? What legal implications maybe encountered when an organizations attempts to enforce their security policies? Explain What is the significant difference between automated and manual policy enforcement? What are some "best" practices YOU recommend for enforcing an organizations security policies? Explain