FFIEC IT Examination Handbook IS-I.A: I.A Security Culture (Information Security)

The board and management understand and support information security and resource its program, so that security processes are embedded in the culture, integrated into lines of business, support functions and third-party management and built into new initiatives from the outset and through their life cycles, and management and employees are held accountable for complying with the program.