Question

An IS auditor is reviewing the effectiveness of an organization's security awareness program. The program consists of mandatory annual e-learning modules with a 98% completion rate. Despite this, the organization continues to experience a high number of successful credential-phishing incidents. Which of the following recommendations would BEST improve the effectiveness of the awareness program?

Accepted Answer

Conduct periodic simulated phishing campaigns and target follow-up training to users who fail

Answer

Increase the passing score required on the annual e-learning module assessment

Answer

Require all employees to sign an acknowledgment of the acceptable use policy each year

Answer

Deploy an additional email gateway to quarantine more suspicious messages