312-50V11 · Question #394
How can a policy help improve an employee's security awareness?
The correct answer is A. By implementing written security procedures, enabling employee security training, and promoting. A formal security policy improves employee awareness by establishing written procedures, enabling structured training, and promoting consistent security behavior.
Question
How can a policy help improve an employee's security awareness?
Options
- ABy implementing written security procedures, enabling employee security training, and promoting
- BBy using informal networks of communication, establishing secret passing procedures, and
- CBy sharing security secrets with employees, enabling employees to share secrets, and
- DBy decreasing an employee's vacation time, addressing ad-hoc employment clauses, and
How the community answered
(24 responses)- A92% (22)
- B4% (1)
- C4% (1)
Why each option
A formal security policy improves employee awareness by establishing written procedures, enabling structured training, and promoting consistent security behavior.
Written security procedures give employees clear, documented guidance on acceptable behavior and required actions. Coupling this with formal security training ensures employees understand both the rules and the reasoning behind them, while promotion of security culture reinforces compliance and awareness organization-wide.
Informal networks and secret passing procedures undermine consistent, auditable security practices and introduce uncontrolled information flow risks.
Sharing security secrets with employees defeats the purpose of access controls and confidentiality, violating the principle of least privilege.
Reducing vacation time and adding ad-hoc employment clauses are HR measures unrelated to technical security awareness or policy compliance.
Concept tested: Security policy role in employee awareness training
Source: https://csrc.nist.gov/publications/detail/sp/800-50/final
Topics
Community Discussion
No community discussion yet for this question.