A newly hired information security manager finds that the organization's security strategy exists on paper but is largely ignored across business units. Middle managers view security as an IT concern and rarely allocate resources to security initiatives. The manager wants to ensure the strategy becomes an enduring, enterprise-wide priority. Which action will MOST effectively establish the foundation for lasting organizational commitment to the security strategy?