IT policies may be initiated by the IT executive leadership, the University Security Officers’ Working Group ... Procedures are considered to be the lowest level in the policy hierarchy tree.