Why is ongoing training important for information security and risk management?

• A. It is optional.
• B. It only covers technical details, not policy.
• C. It raises awareness of policies and handling requirements.
• D. It guarantees security regardless of behavior.

Answer: (C)

Ongoing training matters because information security hinges as much on how people behave as on technology. Regular training keeps everyone aware of the organization's security policies and data handling requirements, so staff know what is expected of them in day-to-day work. It reinforces proper procedures for handling sensitive information, recognizing threats like phishing, and promptly reporting incidents, all of which reduce the chance of human error causing a breach. While training cannot guarantee perfect security, it directly improves awareness and adherence to policies, which lowers risk.

The other options miss this point: making training optional creates gaps in awareness; focusing only on technical details ignores the policy and behavior side of risk; and no training can guarantee security regardless of behavior because risk from human actions can persist despite training.