CISA Governance and Management of IT Practice Question

Correct answer & explanation

The best governance response is to enforce the existing policy through disciplinary actions and additional training (option B). This addresses the root cause of non-compliance—employee behavior—by reinforcing the policy and educating staff. Option A (implementing MFA) is a technical control that may reduce password sharing but does not address the governance aspect; it could be a supporting measure but not the primary governance response. Option C (reporting to regulatory authority) is premature because password sharing does not necessarily constitute a data breach; there is no evidence of actual exposure. Option D (revising the password policy to require more complex passwords) does not prevent sharing and may even increase it if passwords are harder to remember. Therefore, governance should focus on policy enforcement and training.