The correct answer is A because regular security awareness training is the most effective method for communicating general information security responsibilities to all personnel. Awareness training reinforces expected behaviors, reporting obligations, policy requirements, and individual accountability in a way that employees can understand and apply in daily work. Requiring staff to sign confidentiality agreements is important, but it mainly creates legal acknowledgment and does not ensure understanding of broader security responsibilities. Publishing the information security policy on the intranet makes the policy available, but passive publication is not enough to confirm communication or understanding. A RACI matrix is useful for defining roles and responsibilities for specific processes or functions, but it is generally too detailed and role- specific to communicate broad responsibilities across the entire organization. CISM emphasizes that security awareness, communication, and training are essential to building a security-aware culture and ensuring that all individuals understand their responsibilities for protecting information assets.
Reference: CISM Information Security Governance; security awareness, communication, accountability, and security culture principles.