What are the differences between top-down and bottom-up approaches to information security? What are the advantages of the top-down approach over the bottom-up approach?

An information security policy is a formal, high-level statement or plan that embraces an organization's general beliefs, objectives, goals, and acceptable procedures for information security. It defines a set of rules, procedures, and policies designed …