Which of the following is the MOST important activity an organization performs to ensure that securiy is part of the overall organization culture?

Issuing security policies to employees is a foundational administrative control, but distributing documents alone does not create a security-aware culture without leadership support and enforcement mechanisms.

Formal reviews of security incidents are a reactive, operational activity focused on lessons learned after events occur, rather than proactively embedding security into the organizational culture.

Managing security audits is a compliance and assurance activity that measures adherence to controls, but audits are periodic and do not by themselves instill security as a cultural value throughout the organization.

Working with senior management to align security with business goals is the most impactful activity because organizational culture is shaped by leadership priorities and tone-at-the-top. When senior management actively champions security as a business enabler rather than a compliance checkbox, it permeates decision-making, resource allocation, and employee behavior across the entire organization. Without executive buy-in and integration with business objectives, all other security activities lack the authority and cultural weight needed to be truly effective.