Harry's attorney argued that a group that evaluated Harry's security needs failed to follow its own process and perform a risk management assessment.