It is up to them, but it's the CIO's job to advocate for his employees and convince them to do it. You hire a CIO to be able to advise you on decisions such as this. The CIO isn't expected to be down in the trenches resetting Active Directory accounts or applying group policies, of course.