Which of the following BEST enables an organization to determine the effectiveness of its information security awareness program?

The correct answer is B. Evaluating the results of a social engineering exercise. The true measure of a security awareness program's effectiveness is whether it changes actual employee behavior. A social engineering exercise (e.g., a simulated phishing campaign) tests real-world behavioral response and directly reveals whether employees apply what they…

Submitted by yuki_2020· Apr 18, 2026Protection of Information Assets

Question

Options

AMeasuring user satisfaction with the quality of the training
BEvaluating the results of a social engineering exercise
CReviewing security staff performance evaluations
DPerforming an analysis of the number of help desk calls

How the community answered

(23 responses)

A
17% (4)
B
70% (16)
C
4% (1)
D
9% (2)

Explanation

The true measure of a security awareness program's effectiveness is whether it changes actual employee behavior. A social engineering exercise (e.g., a simulated phishing campaign) tests real-world behavioral response and directly reveals whether employees apply what they learned. Measuring user satisfaction (A) reflects perception, not behavioral change or actual security improvement. Reviewing security staff performance evaluations (C) measures the security team, not end-user awareness. Analyzing help desk call volume (D) is an indirect and unreliable proxy-call volume fluctuates for many reasons unrelated to security awareness.

Topics

#Security Awareness Program#Program Effectiveness Measurement#Social Engineering Testing#Security Controls Evaluation

Community Discussion

No community discussion yet for this question.

Full CISA Practice