Between answer options A or D, Option A. Change in senior management makes more sense since a change in senior management is often a significant factor because it can lead to shifts in organizational priorities and strategies, including those related to information security. This can result in a need to align the awareness program with the new management's vision and preferences, potentially leading to a delay. I understand the perspective of option D. Risk appetite but the best of the two options is A.

In the context of the CISM examination, risk appetite refers to the organization's willingness to accept or tolerate risk. If there is a significant misalignment between the risk appetite of the organization and the planned content or approach of the information security awareness program, it may be necessary to delay the program's delivery. Ensuring that the program aligns with the organization's risk appetite is crucial for its effectiveness and support from senior management.

A. Change in senior management A change in senior management should be the primary driver for delaying the delivery of an information security awareness program because the new management team may have different priorities or a different approach to information security. It would be beneficial to align the awareness program with their vision, objectives and priorities before rolling it out. In addition, a new management team may want to review and approve the program before it is delivered to the employees.

A change in senior management could affect the risk appetite of the business, therefor answer D encompasses A as well, as one of the factors that may affect a shift in risk appetite. My answer is D.

A. Change in senior management

D. Risk appetite. The organization may choose to delay the program if it determines that the risks associated with not having the program in place do not justify the costs and effort required to develop and deliver it. Risk appetite reflects the level of risk that an organization is willing to accept, and it can influence decisions regarding investments in security controls and programs.

The risk appetite of an organization determines the level of risk that the organization is willing to accept in order to achieve its objectives. If there is a high risk appetite, the organization may be willing to accept more risk and prioritize other initiatives over an information security awareness program. On the other hand, if there is a low risk appetite, the organization may prioritize the delivery of an information security awareness program to mitigate the risk of security incidents.

high turnover will be delayed the total recognition of policy.

Select Answer: D Risk appetite is the risk that an organization is willing to take. If Risk appetite changes it changes all other courses of information security.

D. Risk appetite: Risk appetite refers to the organization's willingness to accept or tolerate risks. Delaying an information security awareness program may be justified if it is found that the program could introduce risks or if there are higher-priority security initiatives aligned with the organization's risk appetite.

The correct answer is A. Change in senior management. Explanation: Among the options provided, a change in senior management should be the primary driver for delaying the delivery of an information security awareness program. Here's why this option is the primary driver: A. Change in senior management: When there's a change in senior management, priorities, objectives, and strategies can shift. Delaying the information security awareness program ensures that the new leadership team's direction and priorities are properly understood and aligned with the awareness program's goals. In summary, when senior management changes, it's important to ensure that the information security awareness program aligns with the new leadership's direction, making it the primary driver for delaying the program if necessary.

From the CISM Review Manual, 15th Edition, by ISACA (Page 108): "Turnover is another important aspect that should be considered. As people leave and join an organization, there is the need to ensure that the security awareness program reaches everyone, including the new joiners. An organization with a high rate of turnover could potentially delay the delivery of an awareness program to ensure that the maximum number of employees is reached."

If the organization's risk appetite is low, then they encourage and push for more trainings to get their teams familiar on risk reduction. If risk appetite is high, then they wont give much priority for trainings which cause delay or more postpones

Risk Appetite

Which of the following should be the PRIMARY driver for delaying the delivery of an information security awareness program? A. Change in senior management B. High employee turnover C. Employee acceptance D. Risk appetite