Section: INFORMATION SECURITY PROGRAM DEVELOPMENT

If participation in security awareness training is decreasing while incidents are rising, making the training program mandatory for all employees is the best course of action. The CISM Review Manual notes that mandatory training ensures organizational-wide coverage and directly addresses the lack of participation, which is likely contributing to increased incidents.
Reference:ISACA CISM Review Manual, 16th Edition, Page 220-221, "Awareness and Training - Ensuring Coverage".

Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation:
Even in the case of an emergency change, all change management procedure steps should be completed as in the case of normal changes. The difference lies in the timing of certain events. With an emergency change, it is permissible to obtain certain approvals and other documentation on "the morning after" once the emergency has been satisfactorily resolved. Obtaining business approval prior to the change is ideal but not always possible.

The correct answer is C because an outsourced payroll provider will process sensitive employee information, and the contract must require the vendor to comply with the organization's information security policies or equivalent security requirements. Payroll data may include personally identifiable information, salary details, tax information, bank account data, and employment records. The organization remains accountable for protecting this information even when processing is outsourced. Recognized industry standards are useful, but they may not fully reflect the organization's specific policy requirements, risk appetite, privacy obligations, access rules, incident notification needs, or data handling expectations. The most stringent regulations may not always be applicable, and contract requirements should be based on relevant legal, regulatory, and organizational obligations. Service level agreements are important for performance and availability, but they do not fully address security governance. In CISM third-party risk management, contracts should include security requirements aligned with organizational policies, compliance obligations, audit rights, confidentiality, incident reporting, and control expectations. Therefore, vendor compliance with the organization's information security policies is most important.
Reference: CISM Information Risk Management; third-party risk, outsourcing, payroll data protection, contractual security requirements, and vendor compliance principles.