Which of the following is the BEST indicator of a successful organizational information security culture?

The correct answer is D. Staff report suspected information security incidents. A strong information security culture is best demonstrated when staff actively report suspected security incidents. This shows awareness, accountability, and engagement across the organization, indicating that security values are embedded in everyday behavior rather than being…

Submitted by packet_pusher· Apr 18, 2026Information Security Program Development and Management

Question

Options

ASenior management reviews information security issue reports.
BThe audit team conducts periodic compliance audits related to ethics and conflict of interest.
CManagement enforces information security and acceptable use policies.
DStaff report suspected information security incidents.

How the community answered

(46 responses)

A
11% (5)
B
17% (8)
C
7% (3)
D
65% (30)

Explanation

A strong information security culture is best demonstrated when staff actively report suspected security incidents. This shows awareness, accountability, and engagement across the organization, indicating that security values are embedded in everyday behavior rather than being enforced only through management or audits.

Topics

#Information Security Culture#Employee Responsibility#Incident Reporting#Security Awareness

Community Discussion

No community discussion yet for this question.

Full CISM Practice