CISSP Practice Question: Ensure that its security policy is effectively…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Include the policy in the employee handbook

  Why it's wrong here

  Including the security policy in the employee handbook provides a reference document, but it is a passive distribution method. Employees often skim or overlook sections of handbooks, meaning this approach does not actively ensure that personnel have read, understood, or acknowledged the policy's contents. Without a mechanism to confirm engagement, its effectiveness in driving compliance is significantly limited.

• ✓

  Require annual signed acknowledgment of the policy

  Why this is correct

  Requiring annual signed acknowledgment of the security policy is a highly effective method to ensure policy effectiveness. This active engagement process mandates that employees formally confirm they have read, understood, and agree to abide by the policy, creating a clear audit trail and establishing individual accountability. It significantly strengthens the organization's legal standing in cases of non-compliance, demonstrating due diligence in communication.

• ✗

  Conduct random audits and penalize non-compliance

  Why it's wrong here

  While audits are crucial for verifying compliance, conducting random audits and penalizing non-compliance without first ensuring adequate awareness and understanding can be counterproductive and unfair. This approach places the burden of discovery on the employee without confirming the organization's due diligence in policy communication and training. It risks fostering resentment and may not effectively improve security posture if employees genuinely lack awareness of the specific requirements.

• ✗

  Publish the policy on the intranet only

  Why it's wrong here

  Publishing the security policy solely on the intranet is a passive distribution method that does not guarantee employee engagement or comprehension. Employees may not regularly visit the intranet, or they might overlook critical updates among other digital content. This approach lacks any mechanism to confirm that individuals have actually read, understood, or committed to adhering to the policy's stipulations, thus failing to ensure its practical effectiveness.