which approach would be used if senior management is supporting and enforcing the security policy?

When creating a security program, which approach would be used if senior management is
supporting and enforcing the security policy?

A.
A bottom-up approach

B.
A top-down approach

C.
A senior creation approach

D.
An IT assurance approach