Compare and contrast the two most commonly used approaches to information security implementation: bottom-up and top-down.

• Bottom-up approaches implement security policies and/or policies from the ground up where system administrators are responsible for improving the security of the system.
• A top-down approach is quite the opposite where upper management determines security policies for an organization. This is usually the Chief Information Officer (CIO) or the Vice President of Information Technology (VP-IT).

Conclude that often a bottom-up approach rarely works, and a top-down approach has the most effectiveness in an organization.