Question

A newly appointed information security manager finds that development teams routinely bypass security requirements because they view the central security team as a bottleneck. The manager wants to sustainably improve secure behavior within the teams without dramatically increasing central headcount. Which action would BEST achieve this goal?

Accepted Answer

Establish a security champions program that trains and empowers embedded volunteers within each development team

Answer

Implement mandatory monthly security awareness webinars for all development staff

Answer

Add automated security gates in the CI/CD pipeline that block non-compliant builds

Answer

Require the central security team to review and sign off on every code release