An enterprise wants to address the human factors of social engineering risk within the organization. From a governance perspective, which of the following is the BEST way to mitigate this risk?

Distributing a social media information security policy to staff is the BEST governance-level action because it formally establishes clear expectations and rules regarding social media usage and information sharing. This policy provides the necessary framework to guide employee behavior and defines acceptable conduct, directly addressing the human factors contributing to social engineering risks.

Mandating annual security awareness training is important for education, but without a clear formal policy, the training might lack specific actionable guidelines for social media use.

Restricting access to social media is a technical control, which might be part of a broader strategy, but it doesn't directly address the human factor of *understanding* and *adhering* to secure practices when social media is necessary or unavoidable.

Mandating security requirements in employee contracts is a legal measure for accountability, but it doesn't proactively educate or guide employees on daily secure practices regarding social media usage.