Which of the following MUST an organization do to effectively communicate is security strategy to all affected parties?

Involving representatives from key organizational areas is a best practice for developing a security strategy, but it addresses governance and input-not the actual communication of the strategy to all affected parties.

Providing regular updates to the board of directors addresses upward reporting to a specific stakeholder group, but does not ensure the strategy is effectively communicated to all affected parties across the organization.

Notifying staff of changes is a reactive and partial communication activity that only addresses updates to an existing strategy, not the broader requirement of effectively communicating the strategy to all affected parties.

Removing potential communication barriers is the prerequisite for any successful security strategy communication, as barriers such as language differences, lack of access, organizational silos, or technical jargon can prevent the message from reaching all affected parties. Without addressing these barriers first, even well-intentioned efforts like updates or notifications will fail to reach their intended audience. This is a core principle in security awareness and communication frameworks, ensuring the strategy is universally understood and actionable.