Which of the following should be the PRIMARY objective for creating a culture of security within an organization?

Obtaining resources for information security initiatives is a means to achieve security goals, not the primary objective of a security culture itself.

The primary objective for creating a culture of security is to reduce overall organizational risk to acceptable levels by integrating security awareness and practices into the daily routines and mindset of all employees. This collective responsibility and vigilance help prevent incidents stemming from human error or malicious intent, thereby mitigating potential threats and vulnerabilities effectively.

To prioritize security within the organization is an outcome of a strong security culture, but the ultimate goal of that prioritization is the reduction of risk.

Demonstrating control effectiveness to senior management is a management function that might be aided by a strong security culture, but it's not the culture's primary objective.