Security Awareness and Organizational Culture
Key Takeaways
Subdomain 2.3 names organizational culture, including the importance of security and security leadership.
It also names social engineering as a security awareness concept.
Social engineering works on people, so verify requests through a channel the requester did not provide.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 2.3, checked 2026-10-22.
Culture and Leadership
Subdomain 2.3, Understand security awareness, names organizational culture, including the importance of security and security leadership. A culture in which people report problems and follow verification steps is a control in its own right. Leaders set the expectation that a shortcut is not acceptable.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 2.3, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Social Engineering
Subdomain 2.3 also names social engineering. It is the use of deception or pressure on a person to get an action that weakens security. A request from an unexpected sender that asks for urgency or secrecy should be verified through a separate, known channel before anyone acts on it.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 2.3: Organizational culture (e.g., importance of security, security leadership)
- 2.3: Concepts (e.g., social engineering, password protection, phishing)
Common Traps
A common trap is treating awareness as only a technical control. The outline counts culture, leadership, social engineering, and password protection as awareness concepts, so answer with the people behavior the scenario calls for.
An unknown caller claims to be an executive and urgently asks for a password reset. What is the best response?
Verify the request through a known channel before acting
Reset the password because the request is urgent and the caller claims to be a senior executive with authority
Give the password to the caller in a private message so the request is handled quickly and without fuss
Ignore the request and post it on the internal forum so that the wider team can see it and comment
Which statements describe the outline's security awareness concepts? Select all that apply.
Select all that apply
Social engineering is a concept to understand
Organizational culture includes security leadership
Awareness is only a technical control
Password protection is a concept to understand
Sections you finish are checked off in the contents.