Re: "They looked for the password on the CD . . ."
It does, but sometimes (maybe not in this case) there's no reason at all for the data to be password protected; there's simply a blanket demand that all data be password protected.
I sent someone a list of suppliers I'd cut and paste from the internet. Policy was that all data being sent out had to be password protected. Duly zipped it in a password protected zipfile, named "thePasswordIsBeans", with "password = beans" written on the CD.
Policy obeyed, data protected to the level required.