CISM · Question #363
Which of the following is MOST important for building a strong organizational cybersecurity culture?
The correct answer is B. Employees participate in information security awareness and training. Security awareness and training is the foundation of a strong cybersecurity culture because it educates employees about threats, policies, and expected behaviors on an ongoing basis. Culture is built through repeated reinforcement and knowledge-building. Adopting Zero Trust…
Question
Which of the following is MOST important for building a strong organizational cybersecurity culture?
Options
- AEmployees adapt to the foundations of a Zero Trust architecture.
- BEmployees participate in information security awareness and training.
- CEmployees acknowledge security policies and processes.
- DEmployees are included in developing risk scenarios.
How the community answered
(62 responses)- A5% (3)
- B85% (53)
- C8% (5)
- D2% (1)
Explanation
Security awareness and training is the foundation of a strong cybersecurity culture because it educates employees about threats, policies, and expected behaviors on an ongoing basis. Culture is built through repeated reinforcement and knowledge-building. Adopting Zero Trust principles (A) is a technical architecture decision, not a cultural one. Acknowledging policies (C) is a compliance activity but does not build understanding or behavior change. Including employees in risk scenarios (D) is valuable but applies to a small subset of staff. Broad-based awareness and training reaches all employees and continuously shapes security-conscious behavior.
Topics
Community Discussion
No community discussion yet for this question.