Technical teams can evaluate systems and counsel can identify exposure. Leadership must still determine priorities, risk tolerance and authority. Responsible leaders make reasoned decisions, document assumptions, establish controls and revisit them as conditions change.
What leadership should ask now
What is already happening? Who has authority to decide—and who is accountable for the outcome? What information and people are affected? What approval, documentation and monitoring would make the practice defensible?