Certified in Risk and Information Systems Control (CRISC) — Question 620

Which of the following is the MOST effective way to promote organization-wide awareness of data security in response to an increase in regulatory penalties for data leakage?

Answer options

• A. Enforce sanctions for noncompliance with security procedures.
• B. Require regular testing of the data breach response plan.
• C. Conduct organization-wide phishing simulations.
• D. Require training on the data handling policy.

Correct answer: D

Explanation

The correct answer, D, emphasizes the importance of training on the data handling policy, which directly informs employees on best practices and compliance. While the other options may contribute to security awareness, they do not provide the foundational knowledge necessary for understanding data management and protection.