Certified Information Security Manager (CISM)Information Security GovernanceHard
A CISO is reviewing the organization's approach to information security awareness. Despite regular training, employees frequently bypass security controls for convenience, indicating a gap between policy and practice. To address this, the CISO wants to embed security more deeply into the organizational culture and daily operations. Which initiative would be MOST effective in achieving this cultural shift?
- AIntegrating security considerations directly into performance reviews and promotion criteria.
- BIncreasing the budget for advanced technical security solutions to reduce reliance on user behavior.
- CLaunching a continuous phishing simulation program with penalties for repeated failures.
- DImplementing mandatory, annual security compliance questionnaires for all employees.
Show answer & explanationAnswer & explanation
Correct answer: A. Integrating security considerations directly into performance reviews and promotion criteria.
Integrating security into performance reviews and promotion criteria directly links security behavior to career progression and recognition. This incentivizes employees to prioritize security in their daily tasks and fosters accountability, driving a significant cultural shift beyond mere awareness or compliance.
Why the other options are wrong
- B. Technical solutions are important, but ignoring user behavior misses a critical component of a holistic security strategy and cultural transformation.
- C. While useful, a phishing program with penalties can create a negative, fear-based culture rather than a positive, proactive one.
- D. Questionnaires primarily measure knowledge or compliance, not necessarily a deep cultural shift or behavioral change.
Security Culture Integration (Performance)
Embedding information security responsibilities and behaviors into formal human resources processes, such as performance appraisals, job descriptions, and promotion criteria, to drive accountability and cultural transformation.
- Links security to individual success.
- Incentivizes positive security behaviors.
- Fosters accountability and ownership.
- Moves beyond awareness to ingrained practice.
Memory trick: Make security part of their career path.