Which of the following is MOST important for measuring the effectiveness of a security awareness
program?

A.
Reduced number of security violation reports

B.
A quantitative evaluation to ensure user comprehension

C.
Increased interest in focus groups on security issues

D.
Increased number of security violation reports

Explanation:

To truly judge the effectiveness of security awareness training, some means of measurable testing
is necessary to confirm user comprehension. Focus groups may or may not provide meaningful
feedback but, in and of themselves, do not provide metrics. An increase or reduction in the
number of violation reports may not be indicative of a high level of security awareness.