Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation:
No new process will be successful unless it is adhered to by all stakeholders; to the extent stakeholders have input, they can be expected to follow the process. Without consensus agreement from the stakeholders, the scope of the research is too wide; input on the current environment is necessary to focus research effectively.
It is premature to implement procedures without stakeholder consensus and research. Without knowing what the process will be the parameters to baseline are unknown as well.

Explanation/Reference:
Explanation:
Without security awareness training, many components of the security program may not be effectively implemented. The other options may or may not be necessary, but are discretionary.

Explanation
Competitions and rewards are a positive encouragement to user participation in the security program. Merely locking users out for forgetting their passwords does not enhance user awareness. Enforcement of password formats and disciplinary actions do not positively promote awareness.