Which of the following is the BEST indication ofa successful information security culture?

A successful information security culture is characterized by the collective behaviors, attitudes, and shared values of an organization's workforce regarding the protection of information assets. The best indicator of this culture is when end users actively demonstrate security-conscious behavior, such as correctly identifying and promptly reporting potential security incidents or suspicious activities. This proactive engagement proves that security awareness training has been effectively internalized and that employees understand their personal responsibility in safeguarding the organization. While technical assessments, access controls, and adequate funding are critical components of a broader security program, they reflect administrative or operational achievements rather than the actual cultural mindset and daily habits of the human workforce.

A. Regular penetration testing and remediation indicate good technical vulnerability management, but do not reflect the daily security behaviors or mindset of the general workforce.
C. Assigning roles based on job functions is an administrative implementation of the principle of least privilege, not a measure of organizational culture.
D. A sufficient budget indicates executive management's financial commitment to security, but it does not guarantee that employees exhibit secure behaviors.

1. ISACA CISM Review Manual, 15th Edition, Chapter 3: Information Security Program Development and Management, Section 3.8.

2. ENISA, "Cybersecurity Culture Guidelines: Behavioural Aspects of Cybersecurity," 2017, pp. 12-15.