Which of the following is MOST important for measuring the effectiveness of a security awareness program?

A.
Reduced number of security violation reports

B.
A quantitative evaluation to ensure user comprehension

C.
Increased interest in focus groups on security issues

D.
Increased number of security violation reports

Explanation:

To truly judge the effectiveness of security awareness training, some means of measurable testing is necessary to confirm user comprehension. Focus groups may or may not provide meaningful feedback but, in and of themselves, do not provide metrics. An increase or reduction in the number of violation reports may not be indicative of a high level of security awareness.