Which of the following should be the PRIMARY focus of an IT risk awareness program?

A. Cultivate long-term behavioral change
B. Demonstrate regulatory compliance
C. Ensure compliance with the organization’s internal policies
D. Communicate IT risk policy to the participants