The program goals are communicated and understood by the organization is the most important factor for the effective implementation of an information security governance program because it ensures that the program is aligned with the business objectives and supported by the stakeholders. Employees receive customized information security training is not the most important factor, but rather a means to achieve the program goals and raise awareness among the staff. The program budget is approved and monitored by senior management is not the most important factor, but rather a resource to enable the program activities and measure its performance. Information security roles and responsibilities are documented is not the most important factor, but rather a way to define and assign the program tasks and accountabilities. References: https://www.isaca.
org/resources/isaca-journal/issues/2015/volume-1/how-to-measure-the-effectiveness-of-information-security- governance https://www.isaca.org/resources/isaca-journal/issues/2016/volume-2/how-to-align-security- initiatives-with-business-goals-and-objectives