As Part of an Organization's Information Security Governance Process, a Chief

Multiple Choice

As part of an organization's information security governance process, a Chief Information Security Officer (CISO) is working with the compliance officer to update policies to include statements related to new regulatory and legal requirements. Which of the following should be done to BEST ensure all employees are appropriately aware of changes to the policies?

A) Conduct a risk assessment based on the controls defined in the newly revised policies
B) Require all employees to attend updated security awareness training and sign an acknowledgement
C) Post the policies on the organization's intranet and provide copies of any revised policies to all active vendors
D) Distribute revised copies of policies to employees and obtain a signed acknowledgement from them