Does your organization require formal approval from senior management for all security policies?

Security policies should be formally approved by senior management to ensure leadership accountability and organizational alignment with security objectives. This approval process demonstrates management's commitment to security and helps enforce policy compliance throughout the organization. Without senior management approval, policies may lack authority or fail to receive necessary resources for implementation.

Evidence of compliance could include documented approval signatures on policy documents, meeting minutes showing policy review and approval by executive leadership, formal email approvals from senior management, or a governance document that outlines the policy approval process requiring senior management sign-off.