A security manager regualrly checks work areas after buisness hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?

The security manager's activity is a direct form of compliance monitoring. By checking for unsecured files or unlocked computers, the manager is auditing adherence to the organization's security policies (e.g., clean desk and screen lock policies). This verification and enforcement process is a fundamental part of a compliance management program, which aims to ensure that established rules and controls are being followed consistently by personnel.

A. "Audit validation" is not a standard industry term. The activity described is a form of audit or check, not the validation of a separate audit.
B. While the checks involve physical security, the overarching goal is to enforce policy adherence, making "compliance management" the more accurate and comprehensive description of the program part.
D. Security awareness training is the act of educating users. This activity is a check on the effectiveness of that training, falling under the enforcement and compliance function.

1. National Institute of Standards and Technology (NIST). (2011). Special Publication (SP) 800-12 Rev. 1: An Introduction to Information Security. Section 5.3, "Compliance," discusses the importance of enforcing policies through monitoring and reviews.

2. Von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. https://doi.org/10.1016/j.cose.2013.04.004. The paper discusses the evolution of security management, where policy compliance checks are a foundational element.