Which of the following would help to change an organization’s security culture?

A.
Develop procedures to enforce the information security policy

B.
Obtain strong management support

C.
Implement strict technical security controls

D.
Periodically audit compliance with the information security policy

Explanation:

Management support and pressure will help to change an organization’s culture. Procedures will
support an information security policy, but cannot change the culture of the organization. Technical
controls will provide more security to an information system and staff; however, this does not
mean the culture will be changed. Auditing will help to ensure the effectiveness of the information
security policy; however, auditing is not effective in changing the culture of the company.