Meeting periodically with senior managers to discuss the security implications of new information technology uses being considered .
Senior managers meet every three months to talk about security risks .