The manager needs to speak with the CISO. When the carrot doesn't work, you want teeth to enforcing your position.