Corporate culture represents the collective values, beliefs, and behaviors that determine how an organization's employees and management interact and handle business transactions. If an enterprise's culture does not prioritize or value information security, any policy implementation will face significant resistance. Employees may view security controls as hindrances, leading to non-compliance, workarounds, and a general disregard for the policy. A negative or indifferent security culture is the most fundamental and pervasive obstacle because it undermines the human element, which is critical for the success of any security control or procedure, regardless of technology or geographic location.

B. Threats to corporate information are the primary justification for having a security policy, not an obstacle to its implementation. A high-threat environment should facilitate, not hinder, policy adoption.
C. The utilization of cloud-based applications is a technical and architectural challenge that the security policy must address. It complicates implementation but is not a fundamental obstacle like a resistant culture.
D. Geographically dispersed staff presents a logistical challenge for training and enforcement. However, this can be managed with appropriate communication and technology, unlike a deeply ingrained unsupportive culture. ---

1. ISACA

COBIT 2019 Framework: Introduction and Methodology

2018.

Page 31

Figure 4.2

Component 2: Culture

Ethics and Behavior: This core COBIT document

foundational to CGEIT

lists "Culture

Ethics and Behavior" as a critical component of a governance system. The text notes

"The culture

ethics and behavior of individuals and of the enterprise are often underestimated as a success factor in governance and management activities." This directly supports culture as a primary factor for success or

conversely

a major obstacle.

2. ISACA

CGEIT Review Manual

8th Edition

2020.

Domain 1: Governance of Enterprise IT

Section 1.10

Organizational Culture and Awareness: This section emphasizes that for a governance framework to be effective

it must be supported by a culture that reinforces desired behaviors. It states that a lack of a security-positive culture can be a significant barrier to achieving governance objectives

including the effective implementation of security policies.

3. von Solms

B.

& von Solms

R. (2018). Cybersecurity and information security – what goes where? Information and Computer Security

26(1)

2-9.

DOI: https://doi.org/10.1108/ICS-04-2017-0025

This academic article discusses the evolution of information security and highlights that the "human factor

" heavily influenced by organizational culture

is often the weakest link. It implicitly supports the idea that a culture unsupportive of security principles is a greater obstacle than specific technical (cloud) or logistical (geography) issues.