CISM · Question #89
To improve an organization's information security culture, it is MOST important for senior management to:
The correct answer is C. demonstrate good security practices.. To foster a strong information security culture, senior management's most impactful action is to consistently demonstrate good security practices themselves, leading by example.
Question
To improve an organization's information security culture, it is MOST important for senior management to:
Options
- Aparticipate in security training.
- Breview security budget and resources.
- Cdemonstrate good security practices.
- Dapprove security policies.
How the community answered
(31 responses)- A3% (1)
- B16% (5)
- C71% (22)
- D10% (3)
Why each option
To foster a strong information security culture, senior management's most impactful action is to consistently demonstrate good security practices themselves, leading by example.
While participating in security training is beneficial, demonstrating practices carries more weight and visibility in influencing culture than mere participation.
Reviewing budget and resources is a strategic and governance function, but it does not directly impact the day-to-day security culture through visible behavior.
Senior management demonstrating good security practices, such as using strong passwords, locking their screens, and following data handling protocols, sets a visible example for all employees. This leadership by example shows that security is a valued and expected behavior at all levels, fostering a positive security culture throughout the organization more effectively than mandates alone.
Approving security policies is a critical governance responsibility, but it's a formal action; demonstrating those policies in practice is what actively shapes culture.
Concept tested: Leadership's role in security culture
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/adopting-a-security-posture
Topics
Community Discussion
No community discussion yet for this question.