Which of the following BEST enables staff acceptance of information security policies?

Strong senior management support is the most critical factor in fostering staff acceptance of information security policies. This "tone at the top" establishes information security as a core organizational value and a business priority. When leadership visibly champions, funds, and enforces security policies, it creates a culture where compliance is expected and valued. This commitment demonstrates that policies are not merely bureaucratic hurdles but are essential for the organization's success and stability, which is the most powerful driver for employee buy-in and adherence.

B. Computer-based training: Training is essential for awareness and understanding of policies, but without management emphasis, it can be treated as a compliance checkbox rather than leading to genuine acceptance.

C. A robust incident response program: This is a reactive measure that addresses policy failures or breaches. It does not proactively influence the initial acceptance of the policies themselves.

D. Adequate security funding: While necessary to implement controls and programs, funding is a resource. It does not, in itself, shape employee attitudes or guarantee their acceptance of security policies.

1. ISACA

CISM Review Manual

15th Edition. Domain 1: Information Security Governance

Section 1.2.3

"Outcomes of Information Security Governance." The manual emphasizes that the most critical element for a successful information security program is senior management commitment. This commitment ensures that security is integrated into the organizational culture

which directly drives the acceptance and enforcement of policies.

2. von Solms

B.

& von Solms

R. (2004). The 10 deadly sins of information security management. Computers & Security

23(5)

371-376. https://doi.org/10.1016/j.cose.2004.05.002. This academic paper identifies the lack of top management commitment as the "first deadly sin

" stating that without it

"the information security function will never be able to implement and maintain a lasting information security culture

" which is a prerequisite for policy acceptance.

3. D'Arcy

J.

Hovav

A.

& Galletta

D. (2009). User Awareness of Security Countermeasures and Its Impact on Information System Misuse: A Deterrence Theory Perspective. Information Systems Research

20(1)

79-98. This research supports the principle that organizational commitment

demonstrated through management support and the certainty of sanctions for non-compliance

is a key driver for employees to adhere to security policies.