Which of the following is MOST important when building a security-aware culture?

The correct answer is C. Senior management conduct. Senior management conduct is the most important factor in building a security-aware culture because culture is established from the top down. When executives and senior leaders visibly adhere to and champion security policies - using MFA, following clean desk policies…

Submitted by amina.ke· Apr 18, 2026Information Security Governance

Question

Options

ASecurity mission statement
BEmployee beliefs
CSenior management conduct
DOrganizational values

How the community answered

(31 responses)

A
3% (1)
B
3% (1)
C
87% (27)
D
6% (2)

Explanation

Senior management conduct is the most important factor in building a security-aware culture because culture is established from the top down. When executives and senior leaders visibly adhere to and champion security policies - using MFA, following clean desk policies, completing training - it sends a clear signal to the entire organization that security is a genuine priority rather than a compliance checkbox. Employees model the behavior of leadership; if senior management bypasses controls or dismisses security concerns, no amount of policy or training will produce a security-conscious culture. A security mission statement (A) and organizational values (D) provide written guidance, but they are ineffective without behavioral reinforcement from leadership. Employee beliefs (B) are a product of the culture, not a driver of it.

Topics

#Security culture#Management commitment#Leadership role#Security awareness

Community Discussion

No community discussion yet for this question.

Full CISM Practice