The correct answer is D because security culture is strongly influenced by leadership behavior. Senior management must set the tone from the top by consistently demonstrating good security practices, following policies, supporting security initiatives, and making risk-aware decisions. Employees are more likely to adopt secure behavior when they see executives and managers treating security as a business priority. Approving security policies is important, but approval alone does not create culture unless leaders also model expected behavior. Reviewing budget and resources supports the program, but it does not directly shape everyday security behavior. Participating in security training is positive and visible, but demonstrating good security practices on an ongoing basis has a broader cultural impact. In CISM governance, management commitment, accountability, communication, and example-setting are essential for embedding information security into the organization's values and operations. Therefore, leadership behavior is the most important factor in improving information security culture.
Reference: CISM Information Security Governance; security culture, tone at the top, senior management commitment, and organizational behavior principles.