CRISC Certified in Risk and Information Systems ControlGovernanceHard
A pharmaceutical company is conducting extensive research and development (R&D) for a new drug. Due to the highly competitive nature of the industry, intellectual property (IP) protection is critical. The board specifically asks how to foster a culture where all employees understand and prioritize IP protection in their daily activities. Which of the following is the MOST effective approach to cultivate this risk culture?
- AInvest in advanced data loss prevention (DLP) systems to monitor and block unauthorized IP transfers.
- BEstablish a dedicated IP protection department responsible for all IP-related security measures.
- CImplement strict non-disclosure agreements (NDAs) for all employees and contractors.
- DRegularly communicate the value of IP, potential threats, and consequences of breaches through various channels.
Show answer & explanationAnswer & explanation
Correct answer: D. Regularly communicate the value of IP, potential threats, and consequences of breaches through various channels.
Cultivating a strong risk culture requires more than just policies or technology; it demands continuous communication and reinforcement of values. Regularly communicating the importance of IP, threats, and consequences helps embed IP protection into the organizational mindset and daily behaviors of all employees.
Why the other options are wrong
- A. DLP systems are technical controls, but a strong culture reduces the likelihood of insider threats and increases vigilance across the board.
- B. A dedicated department manages IP, but fostering a company-wide culture requires engagement from all employees, not just a specialized group.
- C. NDAs are legal tools but do not, by themselves, foster a proactive culture of awareness and protection.
Risk Culture
The shared attitudes, values, and beliefs that shape risk-taking behavior and risk management practices within an organization.
- Influences how employees identify, assess, and respond to risks.
- Driven by leadership and reinforced through communication and incentives.
- Crucial for effective risk management and governance.
Memory trick: Communicate the 'why' to grow the culture.