The security program will introduce mandatory multifactor authentication and a new data-handling standard affecting every department next quarter. What should the information security manager do FIRST to support adoption?
Select an answer to reveal the explanation.
Short Explanation
Big changes land better when people see them coming, like a weather forecast before the storm you're about to drive into. Start with a communication plan: who's affected, what changes, why it matters and where to get help. Flipping the switch and letting the help desk absorb the fallout is the trap.
Full Explanation
Organization-wide changes to security controls succeed or fail on stakeholder acceptance. A communication plan, prepared before implementation, identifies the affected groups, explains the business reason for the change, sets out the timeline and what each group must do, and provides support channels. It also gives business leaders a chance to raise concerns that may affect scheduling or design, which reduces resistance and the risk of workarounds. Enabling the controls on the planned date without preparation turns predictable questions into incidents, overloads the help desk and encourages users to see security as an obstacle. Publishing the standard and collecting read confirmations is a single, passive message that does not reach most staff, does not explain the reasons and does not prepare people for the practical change in how they log in or handle data. Asking internal audit to test compliance after go-live is an assurance step, not an adoption step, and it comes after the point where communication would have helped. Exam caveat: communication continues after launch, with reminders, feedback collection and adjustments. Operational check: confirm the plan names each stakeholder group, the message owner, the channel and timing, and how feedback and support requests will be tracked.