Security is the responsibility of the entire organization from the very top down. In fact, no security policy will work if the top management do not...

Security is the responsibility of the entire organization from the very top down. In fact, no security policy will work if the top management do not endorse the policy and ensure it is followed. Certainly, they rely on the experts to write the policy and put the proper security controls in place. But management must make it perfectly clear that they support the security policy and failure to follow the policy has dire consequences, such as termination and even prosecution.