CISA Question 224

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  While implementation of a comprehensive security awareness program (option D) is important for promoting a culture of security awareness and education among employees, it may not necessarily provide the best indication that information security expectations are being met at all levels. Security awareness programs are essential components of an organization's overall security strategy, but they primarily focus on educating and empowering employees to recognize and mitigate security risks rather than directly measuring the effectiveness of security controls and processes.

• 1

  A. Achievement of established security metrics