RE: Senior Management Buy-in (was Top Information Security Management Challenges in the Enterprise Today?)

I've been in situations where there was a strong understanding at the
executive level and in situations where the executive team was poorly
informed.  In one particular organization I was a part of, the IT
department heads felt that it was inappropriate to involve the
executive team - I remember the quote "they just don't fly that low" -
needless to say that after several months of struggling to establish a
security program in this environment we made very little progress.
Those companies where the executive team is aware of and visibly
endorses security policy and accountability (that is also supported by
a strong employee awareness and training program) have had the most
successful security programs and have been able to drive significant
efficiencies out of the efforts.      

-Brad Bemis

-----Original Message-----
From: john_blackley@dell.com [mailto:john_blackley@dell.com] 
Sent: Tuesday, November 08, 2005 10:09 AM
To: security-management@securityfocus.com
Subject: Re: Senior Management Buy-in (was Top Information Security
Management Challenges in the Enterprise Today?)

Further to Brad's excellent post on gathering success stories, I'd
like to ask one favor (because it's an issue in which I have an
interest): When responding, can you give some indication of whether -
or not - you believe your senior management know and understand the
content of their information security policies?