Try a CISM question.

Information Security Governance

A public agency's annual culture survey shows that 70% of employees fear punishment if they report a security mistake, and near-miss reports have dropped to almost zero, although policy compliance scores remain strong. Which conclusion is BEST supported by these findings?

• AThe agency's security awareness training content is out of date and should be revised
• BPolicy compliance scores demonstrate the culture is strong regardless of reporting behavior
• CA punitive reporting climate is suppressing the early signals the program needs to improve
• DThe agency should increase disciplinary action to reinforce accountability for security errors