Business plan and strategy

In your own words, explain why a business plan and strategy would be created using a top-down methodology, while InfoSec procedures and guidelines would normally be created using a bottom-up methodology.