Which of the following would help to change an organization’s security culture?

A.
Develop procedures to enforce the information security policy

B.
Obtain strong management support

C.
Implement strict technical security controls

D.
Periodically audit compliance with the information security policy

Explanation:
Management support and pressure will help to change an organization’s culture. Procedures will support an information security policy, but cannot change the culture of the organization. Technical controls will provide more security to an information system and staff; however, this does not mean the culture will be changed. Auditing will help to ensure the effectiveness of the information security policy; however, auditmg is not effective in changing the culture of the company.