When promoting a new risk management policy, which of the following is the BEST way for an information security manager to change the existing information security culture?

The correct answer is A. Implement an organization-wide security awareness campaign. An organization-wide security awareness campaign is the best way to change culture because it drives understanding and behavior change at scale, reinforcing expectations and embedding the new policy into daily actions rather than merely distributing the policy.

Submitted by saadiq_pk· Apr 18, 2026Information Security Program Development and Management

Question

Options

AImplement an organization-wide security awareness campaign.
BDisseminate the policy to all employees across the organization.
CModify the existing organizational structure to support the new policy.
DDemonstrate how the new policy aligns with industry best practices.

How the community answered

(18 responses)

A
83% (15)
B
11% (2)
C
6% (1)

Explanation

An organization-wide security awareness campaign is the best way to change culture because it drives understanding and behavior change at scale, reinforcing expectations and embedding the new policy into daily actions rather than merely distributing the policy.

Topics

#Security Culture Change#Security Awareness#Policy Implementation#Risk Management Policy

Community Discussion

No community discussion yet for this question.

Full CISM Practice