Organizational Culture CISM Practice Questions (Page 6)

Questions 26–27

1. 26expert · hard

   A security manager is leading a culture change initiative to improve security awareness. The company has a history of failed initiatives due to employee cynicism. The manager has limited budget and must show quick wins to gain credibility. Which approach is most appropriate?

   • ALaunch a comprehensive awareness campaign with posters, emails, and town halls.
   • BWait for a major security incident to justify the need for change.
   • CImmediately implement new security tools to demonstrate commitment.
   • DStart with a small pilot in one department, measure results, and share success stories.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security manager wants to create a security-aware culture in a company with a highly autonomous workforce, where employees value independence. Which approach is most likely to succeed?

   • AImplement strict monitoring of employee activities to ensure compliance.
   • BCreate a security policy that is as detailed as possible to eliminate ambiguity.
   • CIssue a directive from the CISO mandating specific security behaviors.
   • DProvide guidelines and empower employees to make secure decisions within those guidelines.
   Reveal Solution Discussion Select an answer first