The information security manager has drafted a revised information security policy that sets direction for the whole organization. Who should approve it?
Select an answer to reveal the explanation.
Short Explanation
Whoever's name is on the line should sign it. Senior management owns information security governance, so they approve the policy, while you, as the security manager, write it and keep it current.
Full Explanation
An information security policy expresses management's direction and commitment, and its authority derives from the approval of those accountable for governance. Senior management approval signals that the policy reflects business priorities, gives it the weight needed for enforcement across all functions, and confirms that leadership accepts accountability for its implications. The information security manager typically drafts, consults on and maintains the policy, but approving their own draft would lack the authority required to bind other functions and would blur the line between advising and deciding. The IT director's teams may implement many controls, yet information security spans the entire organization, including people, processes and third parties, so approval by one operational function would be too narrow and would present security as an IT concern. Internal audit provides independent assurance on compliance and must remain independent of the policies it audits; approving the policy would compromise that role. Exam caveat: some organizations route approval through a steering committee or the board, and that still represents senior governance authority rather than an operational function. Operational check: confirm the approved policy records the approving body, approval date and next review date, and that it has been communicated across the organization.