Which of the following is the MOST important consideration when attempting to create a security- focused culture?

The correct answer is B. The current security awareness level of the employees. Building a security culture requires meeting people where they are. Before designing any culture change initiative, understanding employees' current security awareness level establishes the baseline from which to measure progress and informs what kind of training, messaging…

Submitted by parkjh· Apr 18, 2026Information Security Program Development and Management

Question

Which of the following is the MOST important consideration when attempting to create a security- focused culture?

Options

AThe organization's existing security policies, procedures, and frameworks
BThe current security awareness level of the employees
CCurrent security strategy benchmarks against peer organizations
DThe regional rules and legislation regarding information security

How the community answered

(27 responses)

B
89% (24)
C
7% (2)
D
4% (1)

Explanation

Building a security culture requires meeting people where they are. Before designing any culture change initiative, understanding employees' current security awareness level establishes the baseline from which to measure progress and informs what kind of training, messaging, and behavioral nudges will be most effective. Without this assessment, efforts may be pitched too advanced or too remedial, wasting resources and failing to produce behavioral change. Option A (existing policies and frameworks) provides the rules but not insight into human behavior. Option C (benchmarking peers) offers external context but ignores internal reality. Option D (regional laws) defines minimum compliance requirements but does not drive cultural transformation.

Topics

#Security Culture#Security Awareness#Human Factors#Program Development

Community Discussion

No community discussion yet for this question.

Full CISM Practice