The organization's information security policy contains specific product configuration settings and must be revised and reapproved by senior management several times a year as technology changes. What should the information security manager do?

Policies should express management's direction at a level that remains valid over time, because they require senior management approval and broad communication. When a policy contains specific product settings, every technology change forces a policy revision, consuming executive attention and making the policy unstable. The correct structure moves detailed, technology-specific requirements into standards, and step-by-step configuration into procedures, both of which can be maintained by appropriate owners under the policy's authority. The policy then states intent and principles that rarely change. Increasing review frequency accepts the flawed structure and adds more approval cycles, making the problem worse. Delegating policy approval to IT removes senior management's ownership of policy, undermining governance and the authority that gives policy its force. Removing the settings without documenting them elsewhere eliminates the specific requirements that operations need, leading to inconsistent configurations. Exam caveat: standards still require appropriate approval, typically at a lower level than policy, and must remain traceable to the policy they support. Operational check: confirm the revised policy contains no product-specific settings, and that each moved setting now resides in an owned, approved standard that references the policy.