Free CISM Exam Flashcards

The organization's security culture: its risk tolerance, attitude to rules and the pressures behind login sharing. Controls that ignore how people actually work are bypassed, so understanding the culture first lets the manager choose controls and messages that fit behavior, and it shows where enforcement or process redesign is needed.