Which of the following would BEST enhance employee compliance with security policies?

The correct answer is B. Implement a security awareness program. A security awareness program is the most effective approach because it educates employees on WHY policies exist, what threats they face, and what behaviors are expected - building a security culture that drives voluntary compliance. Incorporating policies into job descriptions…

Submitted by fernanda_arg· Apr 18, 2026Information Security Program Development and Management

Question

Options

AIncorporate security policy into position descriptions.
BImplement a security awareness program.
CRequire employee signed acceptance of policy.
DAdminister periodic employee security quizzes.

How the community answered

(25 responses)

A
4% (1)
B
80% (20)
C
8% (2)
D
8% (2)

Explanation

A security awareness program is the most effective approach because it educates employees on WHY policies exist, what threats they face, and what behaviors are expected - building a security culture that drives voluntary compliance. Incorporating policies into job descriptions (A) sets expectations but does not teach understanding. Signed acceptance of policy (C) creates a legal acknowledgment but does not ensure comprehension or behavioral change. Periodic quizzes (D) test retention but are limited in scope and frequency. Ongoing awareness programs address the root cause of non-compliance: lack of knowledge and security culture.

Topics

#Security awareness#Employee compliance#Security policies#Training

Community Discussion

No community discussion yet for this question.

Full CISM Practice