Which of the following BEST enables staff acceptance of information security policies?

The most critical factor in ensuring staff acceptance of information security policies is strong senior management support. In information security governance, the "tone at the top" dictates the organizational culture and demonstrates that security is a critical business priority rather than just an IT issue. When executive leadership actively endorses and models compliance with security policies, it cascades down through the organization, fostering a culture of security awareness and accountability. While training and funding are necessary components of a security program, they are secondary to the foundational mandate and visible commitment provided by senior management, which ultimately drives user buy-in and behavioral change across all departments.

B. Computer-based training is a delivery mechanism for awareness but is largely ineffective without the mandate and cultural drive from senior management.
C. An incident response program is a reactive operational capability and does not proactively drive staff acceptance of security policies.
D. Adequate funding enables the purchase of tools and resources but does not inherently influence employee behavior or policy acceptance.

1. ISACA. (2016). CISM Review Manual, 15th Edition. Chapter 1: Information Security Governance, Section 1.3 (Effective Information Security Governance), pp. 18-20.

2. International Organization for Standardization (ISO). (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection. Clause 5.1 (Leadership and commitment).