Two months after a new acceptable use policy was published on the intranet, a survey shows that most employees are unaware of it. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
A rule nobody's heard of is a rule nobody follows. You actively communicate it and get people to acknowledge it, rather than punishing folks for breaking a policy they didn't know existed.
Full Explanation
Publishing a policy is not the same as communicating it. For a policy to influence behavior and to be enforceable, staff must be made aware of it, understand what it requires and confirm that they have received it. Communicating through awareness channels such as training, team briefings and onboarding, and obtaining acknowledgment, establishes awareness and creates a record supporting later enforcement. Disciplining employees who violated a policy they were unaware of is unfair, likely to be contested and damages the security culture; enforcement depends on prior communication. Republishing on the intranet with a banner repeats the passive approach that has already failed; visibility on a web page does not ensure people read or understand it, and it provides no acknowledgment. Delaying enforcement until the next annual review leaves the policy ineffective for most of a year and does nothing to build awareness; the problem is communication, not the policy's content. Exam caveat: acknowledgment is evidence of receipt, not of understanding, so awareness efforts should explain the reasons behind the policy as well. Operational check: track acknowledgment completion rates by department, follow up on gaps, and include the policy in onboarding for new staff.