I strongly suspect that mimecast just sets some general rules for all. In this cost-cutting age it is hard to imagine the university researching, testing, and tracking rules