A security manager wants to show the executive committee whether the organization's security culture is actually improving. Which indicator is the MOST meaningful?
Select an answer to reveal the explanation.
Short Explanation
Culture is what people do when nobody's checking. A 100 percent course completion rate tells you people clicked through a module; people reaching out on their own to report something weird tells you they actually care. The trap is the shiny compliance number.
Full Explanation
Security culture is reflected in behavior, especially discretionary behavior that no policy can fully compel. An increase in the volume and speed of voluntary reports of suspicious activity shows that employees recognize threats, understand that reporting matters and feel safe doing it, which are the core attributes of a healthy culture. Training completion is a compliance measure; reaching full completion shows that the course was assigned and tracked, but says little about whether attitudes or actions changed. Doubling the number of published policies measures documentation output and may even signal policy sprawl rather than adoption. A reduction in audit findings against IT general controls reflects the design and operation of specific technical and process controls, which is a different question from how the broader workforce thinks and acts about security. Exam caveat: a reporting increase can also reflect a genuine rise in attacks, so the indicator should be read alongside threat data and the time-to-report trend, but as a culture measure it remains far more informative than activity counts. Operational check: trend voluntary reports per employee and median time from suspicious event to report over several quarters, and compare against phishing simulation report rates.