ExamGecko
Question list
Search
Search

Question 130 - CISM discussion

Report
Export

Which of the following is MOST important to consider when aligning a security awareness program with the organization's business strategy?

A.
Regulations and standards
Answers
A.
Regulations and standards
B.
People and culture
Answers
B.
People and culture
C.
Executive and board directives
Answers
C.
Executive and board directives
D.
Processes and technology
Answers
D.
Processes and technology
Suggested answer: B

Explanation:

A security awareness program is a set of activities designed to educate and motivate employees to adopt secure behaviors and practices. A security awareness program should be aligned with the organization's business strategy, which defines the vision, mission, goals and objectives of the organization. The most important factor to consider when aligning a security awareness program with the business strategy is the people and culture of the organization, because they are the primary target audience and the key enablers of the program. The people and culture of the organization influence the level of awareness, the attitude and the behavior of the employees towards information security. Therefore, a security awareness program should be tailored to the specific needs, preferences, values and expectations of the people and culture of the organization, and should use appropriate methods, channels, messages and incentives to engage and influence them. A security awareness program that is aligned with the people and culture of the organization will have a higher chance of achieving its objectives and improving the overall security posture of the organization.

Reference=

CISM Review Manual 15th Edition, page 1631

CISM 2020: Information Security & Business Process Alignment, video 22

asked 01/10/2024
Ezrah James panuelos
37 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first