Make things obvious by tying to core company values or how certain aspects might be against them. If you have security teams that take their job seriously, they can help draft policy. There are ways to approach this properly and still CYA.

Don’t forget, it’s the CEO’s job to choose whether or not to have you steer towards the iceberg. If he chooses to drive hard and fast right into it, maybe it was meant to be.