Which of the following BEST indicates an effective security culture?

The correct answer is D. Information security is seen as a key business partner and enabler. A true security culture exists when security is embedded into the organization's identity and business strategy - not treated as a compliance burden or a siloed IT function. When business units view information security as a strategic partner and enabler that helps them achieve g

Submitted by emma.c· Apr 18, 2026Information Security Governance

Question

Which of the following BEST indicates an effective security culture?

Options

ASecurity standards and policies are communicated to and followed by staff
BStaff are encouraged by senior management to report security incidents
CSecurity risk is managed and maintained within acceptable levels
DInformation security is seen as a key business partner and enabler

How the community answered

(47 responses)

A
4% (2)
B
23% (11)
C
9% (4)
D
64% (30)

Explanation

A true security culture exists when security is embedded into the organization's identity and business strategy - not treated as a compliance burden or a siloed IT function. When business units view information security as a strategic partner and enabler that helps them achieve goals safely, it signals that security thinking has been genuinely internalized at all levels. Option A describes policy compliance, which is a component of culture but can exist through enforcement rather than genuine adoption. Option B (incident reporting) and Option C (managed risk) are desirable outcomes of a security program but are narrower indicators than the broad organizational mindset described in Option D.

Topics

#Security Culture#Business Alignment#Strategic Security#Security Governance

Community Discussion

No community discussion yet for this question.

Full CISM Practice