Which of the following is the MOST likely to change an organization’s culture to one that is more security
conscious?

A.
Adequate security policies and procedures

B.
Periodic compliance reviews

C.
Security steering committees

D.
Security awareness campaigns

Explanation:

Security awareness campaigns will be more effective at changing an organizational culture than the creation of steering committees and security policies and procedures. Compliance reviews are helpful; however,
awareness by all staff is more effective because compliance reviews are focused on certain areas groups and do not necessarily educate.