Which of the following is MOST important to convey to employees in building a security risk- aware culture?

Question

Options

• AUnderstanding an information asset's value is critical to risk management.
• BEmployee performance goals include information security objectives.
• CEmployee access should be based on the principle of least privilege.
• DThe responsibility for security rests with all employees.

• A
  3% (1)
• B
  7% (2)
• C
  3% (1)
• D
  86% (25)

Explanation

Building a security risk-aware culture hinges on changing mindsets and behaviors across the entire organization - and that requires every employee to understand that security is their responsibility, not just IT's or the security team's. Without this shared ownership, policies and controls will be undermined by the human element regardless of how technically sound they are.

Why the distractors fall short:

• A (asset value) is important to risk analysts and managers, not something every employee needs to internalize to be security-aware - it's a specialized risk management concept.
• B (performance goals) is a mechanism to enforce security behavior, but it doesn't build genuine culture; compliance through KPIs isn't the same as awareness.
• C (least privilege) is a sound access control principle applied by administrators - it's a technical/procedural control, not a cultural message for the general workforce.

Memory tip: Think of culture as a "whole team sport" - the question asks what's most important to convey (i.e., communicate and instill), and the only message broad enough to apply to every single employee is shared ownership (D). The other options describe practices or roles, not a universal cultural value.

No community discussion yet for this question.