When creating a security program, which approach would be used if senior management is supporting and enforcing the security policy?

A bottom-up approach is initiated by IT staff or lower-level employees, not senior management, and typically lacks the authority to enforce policy organization-wide.

In a top-down approach, senior management is the driving force behind creating and enforcing the security policy - they mandate compliance throughout the organization and allocate the necessary resources. This contrasts with a bottom-up approach where IT staff attempt to implement security without executive backing. Senior management involvement is essential for a program to carry organizational authority and long-term effectiveness.

'Senior creation approach' is not a recognized or standardized security program methodology.

'IT assurance approach' is not a standard term used to describe a security program creation strategy.