Certified Information Security Manager (CISM)Information Security ProgramMedium
A CISO has implemented a new security awareness program across the organization. After six months, a survey reveals that while employees understand the security policies, there has been no significant reduction in reported phishing attempts or insecure practices. Which of the following is the MOST likely reason for the program's limited effectiveness?
- AThe program did not include regular phishing simulations or practical exercises.
- BThe organization's security culture does not adequately reinforce secure behaviors.
- CThe training content was not engaging or relevant to employees' daily tasks.
- DThe security awareness program lacked executive sponsorship and funding.
Show answer & explanationAnswer & explanation
Correct answer: B. The organization's security culture does not adequately reinforce secure behaviors.
Even with good training, if the organizational culture doesn't support or enforce secure practices through leadership, incentives, and consequences, employees may not translate knowledge into behavior change. A strong security culture is essential for sustained effectiveness.
Why the other options are wrong
- A. Phishing simulations are valuable, but the core issue described is a lack of behavior change despite policy understanding, pointing to a deeper cultural problem.
- C. While engaging content is important, the scenario states employees 'understand the security policies,' implying content comprehension isn't the primary issue.
- D. Lack of sponsorship and funding would likely prevent the program from even being implemented or sustained, which contradicts the scenario where it was implemented.
Security Culture
The shared values, beliefs, attitudes, and behaviors concerning information security that exist within an organization.
- Influences how employees perceive and act on security policies.
- Reinforced by leadership, communication, and consequences.
- Essential for translating awareness into secure behaviors.
Memory trick: Knowing is half the battle, but culture makes the other half a victory or defeat.