When creating a security program, which approach would be used if senior management is supporting and enforcing the security policy?

A. A bottom-up approach

B. A top-down approach

C. A senior creation approach

D. An IT assurance approach