Certified Information Security Manager (CISM)Information Security ProgramHard
An organization's information security program has been in place for several years, but recent internal audits indicate a decline in compliance with security policies and an increase in security-related incidents. The CISO needs to revitalize the program's effectiveness. Which action would MOST directly address the underlying issue of declining compliance and increasing incidents?
- AInvesting in a new generation of endpoint detection and response (EDR) tools.
- BRevising the security awareness and training program to focus on behavioral change and accountability.
- CConducting a comprehensive review and update of all security policies and standards.
- DHiring additional security analysts to monitor security events 24/7.
Show answer & explanationAnswer & explanation
Correct answer: B. Revising the security awareness and training program to focus on behavioral change and accountability.
Declining compliance and increasing incidents often point to a breakdown in human behavior and accountability. While new tools, policy updates, or more staff can help, a revised awareness program focusing on behavioral change and accountability directly targets the root cause of people not adhering to existing policies, thereby improving compliance and reducing incidents.
Why the other options are wrong
- A. New EDR tools address technical detection and response but not the underlying human compliance issues.
- C. Policy updates are good, but if people aren't following the old ones, new ones won't solve the compliance problem without addressing behavior.
- D. More analysts help with monitoring but don't inherently improve compliance or prevent incidents caused by human error or negligence.
Behavioral Security Awareness
Security awareness and training programs designed not just to inform, but to actively change employee behavior and foster a culture of accountability regarding information security practices.
- Focuses on human element.
- Aims for sustained behavioral change.
- Reduces human-caused incidents and non-compliance.
Memory trick: Behavioral Boost Brings Better Belief.