CISSP practice question 10 of 35

Which of the following is the MOST important activity an organization performs to ensure that securiy is part of the overall organization culture?

Full set: 1,485 questions

Domain Security and Risk Management

Answer options

A: Ensue security policies are issued to all employees

B: Perform formal reviews of security Incidents.

C: Manage a program of security audits.

D: Work with senior management to meet business goals. Correct answer

Correct Answer:

D. Work with senior management to meet business goals.

Explanation

The most critical activity for embedding security into an organization's culture is ensuring it is aligned with and supports the business's strategic goals. This requires active collaboration with senior management. When security is perceived as a business enabler rather than a cost center, it receives top-down support, funding, and prioritization. This leadership commitment is the foundation upon which a security-conscious culture is built, as it signals the importance of security to the entire organization. Without this strategic alignment and executive sponsorship, other security activities like policy issuance or audits remain tactical compliance exercises rather than integral cultural values.

References

1. Stewart

J. M.

Tittel

& Chapple

M. (2021). CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide (9th ed.). Wiley. In Chapter 1

"Security and Risk Management

" the text states

"Senior management creates the security program and ensures that it is properly staffed

funded

and has organizational priority. It is responsible for making the decisions that set the tone for the entire organization." (p. 6). This highlights the foundational role of senior management.

2. (ISC)². (2021). Official (ISC)² CISSP CBK Reference (6th ed.). In Domain 1

"Security and Risk Management

" the concept of security governance is detailed

emphasizing that governance must align with business strategy. The text notes

"The governance process must be driven from the top of the organization (e.g.

board of directors and senior executives) down..." (p. 4).

3. Da Veiga

& Eloff

J. H. P. (2010). A framework and assessment instrument for information security culture. Computers & Security

29(2)

196-207. https://doi.org/10.1016/j.cose.2009.09.002. The research identifies "Management support and leadership" as a critical dimension for establishing and measuring an information security culture

reinforcing that leadership's role is paramount.

Question breakdown

Tests: Align security governance with business strategy and senior management
Difficulty: Easy

Key idea: Security becomes part of organizational culture when it is aligned with business goals and visibly backed by senior management, rather than imposed as a set of tactical controls.

How to reach the answer

Note the qualifiers 'MOST important' and 'overall organization culture'. Together they signal a governance-level answer, not an operational one.
Culture is shaped from the top down. Leadership sets tone, priorities, and funding.
Policies, incident reviews, and audits all depend on management support to have any lasting cultural effect.
Option D is the only choice that ties security to business goals through senior management, so it is the foundational activity.

Each option

AIncorrect. Handing out policies spreads awareness, but it does not create buy-in, and without leadership backing policies are often ignored.
BIncorrect. Formal incident reviews are a reactive, operational improvement activity rather than the driver of organization-wide culture.
CIncorrect. An audit program measures compliance after the fact and can make security feel like policing rather than a shared value.
DCorrect. Working with senior management to support business goals gives security executive sponsorship and strategic relevance, which is the foundation of a security culture.

Common trap: Option A is tempting because policies are the formal expression of security intent, but issuing documents is a tactical step that only works once leadership has established security as a business priority.

In practice: Security leaders who present risk in business terms to executives and tie controls to strategic objectives get the funding, staffing, and tone-from-the-top messaging that make employees take security seriously.

Remember: For 'most important' governance or culture questions, pick the option that aligns security with business objectives through senior management support.

Official documentation: CISSP Certification - ISC2

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free CISSP practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test