For example, management approval was needed before individuals could share information about potentially sensitive incidents and vulnerabilities.
Management approval was needed before individuals could share information about incidents and vulnerabilities 
Management approval was not needed to submit a report