A security policy is technically detailed, changes weekly, and requires board approval for every parameter. What improvement is most appropriate?

1. Separate high-level policy from supporting standards and procedures
2. Require the board to approve every firewall rule
3. Remove all technical standards
4. Let each engineer define policy independently