Meeting periodically with senior managers to discuss the security implications of new information technology uses being considered.
Senior managers meet every three months to talk about security risks.