Organizational Culture CISM Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company's governance objectives require a high level of security compliance, but the organization has a culture of 'trust' where employees are given significant freedom and oversight is minimal. The security manager wants to align culture with governance. Which approach is most likely to be successful?

   • ARely on the existing trust culture to ensure employees will follow security policies voluntarily.
   • BGradually introduce security controls that are transparent and explain the reasons behind them.
   • CReplace the trust-based culture with a compliance-based culture through a major reorganization.
   • DImplement strict monitoring and surveillance to ensure compliance.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's leadership wants to make security a core value, but employees see it as a set of restrictive rules. The security manager proposes a program to align culture with this goal. Which element is most critical to include?

   • ARewards and recognition for employees who demonstrate secure behaviors.
   • BA new security awareness video featuring senior executives.
   • CA quarterly security audit to measure compliance with policies.
   • DA detailed policy document outlining all security requirements.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security manager wants to promote a security-aware culture in a multinational company with diverse regional cultures. Some regions have high power distance, where employees expect directives from leadership, while others have low power distance, where employees expect participatory decision-making. What is the best approach?

   • AUse a peer-to-peer approach in all regions to encourage collaboration.
   • BTailor the program to each region, using local leadership endorsement in high-power-distance regions and participatory workshops in low-power-distance regions.
   • CFocus only on regions with the highest security risk to maximize impact.
   • DImplement a single global security awareness program with standardized messaging.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has a culture that values 'blameless' problem-solving, but the security team wants to enforce a new policy that requires reporting all security incidents, even minor ones. Employees fear that reporting will lead to blame. How should the security manager address this conflict?

   • AReassure employees that reporting will be used for learning, not punishment, and demonstrate this through handling of incidents.
   • BImplement an automated system that reports incidents without employee involvement.
   • CMake reporting mandatory and punish employees who fail to report incidents.
   • DLimit the reporting requirement to only major incidents to reduce the burden.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company's governance objectives require strict data protection, but the sales team has a culture of sharing customer information freely to close deals. The security manager must align the sales culture with governance objectives without hurting sales performance. Which strategy is most effective?

   • AImplement a data loss prevention (DLP) system that blocks all external sharing of customer data.
   • BConduct a training session on the importance of data protection and the risks of sharing customer data.
   • CRevise the governance objectives to allow more flexible sharing of customer data.
   • DWork with sales leadership to develop secure sharing practices that meet both sales and security needs.
   Reveal Solution Discussion Select an answer first