Who should be involved in the development of an internal campaign to address email phishing?

The Information Security Governance program MUST:

Which of the following best describes revenue?

Which of the following is MOST useful when developing a business case for security initiatives?

Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the "real workers." What must you do first in order to shift the prevailing opinion and reshape corporate culture to understand the value of information security to the organization?