In risk management,

top-down

is usually the recommended approach for large and complex organi-

sations. In this approach, security management starts the process from staff at the top hierarchy of the

organisation, then middle management, and finally staff at the bottom level of the organisation. What

exactly security management needs to know at each level of the hierarchy? Give two (2) examples for

each level of the organisation hierarchy to answer this question