Which of the following is the PRIMARY impact of organizational culture on the effectiveness of an information security program?

The correct answer is B. The culture shapes behaviors toward information security. Organizational culture is the primary driver of human behavior, which is the most variable and impactful factor in information security. A culture that values security leads employees to naturally follow policies, report incidents, and resist social engineering. The assertion…

Submitted by ricky.ec· Apr 18, 2026Information Security Governance

Question

Options

AThe culture has minimal impact as long as information security controls are adhered to.
BThe culture shapes behaviors toward information security.
CThe culture defines responsibilities necessary for program implementation.
DThe culture helps determine budget for information security controls.

How the community answered

(52 responses)

A
2% (1)
B
88% (46)
C
8% (4)
D
2% (1)

Explanation

Organizational culture is the primary driver of human behavior, which is the most variable and impactful factor in information security. A culture that values security leads employees to naturally follow policies, report incidents, and resist social engineering. The assertion that culture has minimal impact as long as controls are followed (A) is backwards - culture determines whether controls are followed. Culture does not define formal responsibilities (C), which belong to governance structures and job descriptions. Budget decisions (D) are driven by financial planning and executive priorities, not culture alone.

Topics

#Organizational Culture#Information Security Program Effectiveness#Security Behavior#Human Factors in Security

Community Discussion

No community discussion yet for this question.

Full CISM Practice