Who would be the BEST person to approve an organizations information security policy?

The Chief Information Officer (CIO) oversees overall IT strategy and operations, but the specialized responsibility for information security policy approval typically resides with the CISO, who focuses solely on security.

The Chief Information Security Officer (CISO) holds ultimate executive responsibility for an organization's information security program, which explicitly includes the development, implementation, and governance of security policies. Approving these policies is a core function ensuring they align with the organization's risk posture and regulatory requirements.

A Chief internal auditor's primary function is to evaluate the effectiveness of policies and controls, not to create or formally approve the policies themselves.

The Chief Executive Officer (CEO) has ultimate organizational authority but typically delegates specific policy approvals to functional heads like the CISO, who possess the domain expertise and direct responsibility for information security.