Security policy may be established globally by top-level administration or some security policy matters may be delegated to middle level administrators and perhaps even individuals.
