Requirement 12.3.1

Explicit management approval