Certified Information Security Manager (CISM)Information Security GovernanceMedium
A CISO is tasked with improving the organization's information security posture by enhancing employee behavior. Despite having formal security policies and annual training, incidents stemming from human error persist. The CISO wants to move beyond mere compliance to foster a proactive security culture. Which of the following initiatives would be MOST effective in achieving this goal?
- AAutomating more security controls to reduce reliance on human vigilance.
- BImplementing stricter disciplinary actions for security policy violations.
- CIncreasing the frequency and duration of mandatory security awareness training sessions.
- DEstablishing a 'security champion' program with departmental representatives.
Show answer & explanationAnswer & explanation
Correct answer: D. Establishing a 'security champion' program with departmental representatives.
A security champion program empowers employees within their own departments to promote security best practices, act as local points of contact, and tailor security messages, fostering a proactive and embedded security culture beyond top-down mandates.
Why the other options are wrong
- A. Automation reduces some risks, but a strong security culture is still essential for handling novel threats and ensuring responsible user behavior.
- B. While disciplinary actions have a place, they primarily enforce compliance and may not foster a proactive, positive security culture.
- C. More training alone may lead to fatigue and not necessarily translate into behavioral change or a proactive culture.
Security Champion Program
An initiative that designates and empowers employees within various departments to act as local advocates, educators, and first points of contact for information security within their teams.
- Fosters peer-to-peer security advocacy.
- Embeds security into daily operations.
- Builds a proactive, positive security culture.
Memory trick: Turn employees into security advocates.