What it asks for. Management should require all personnel to apply information security in line with the organisation's policies and procedures. Managers are expected to set the example and support security in their teams.
In practice. Line managers ensure their staff are briefed on security responsibilities, complete required training, follow policies and have the access appropriate to their roles. Security expectations appear in management objectives and performance discussions, and managers are expected to act on incidents or breaches of policy. Evidence includes management briefings, training completion tracked by team, and examples of managers following up on non compliance.
Common gaps. Managers often see security as the security team's job and do not challenge their own staff. Senior people frequently request exceptions to policy, which undermines the message for everyone else.