Which of the following should be the PRIMARY focus of an IT risk awareness program? 

Cultivate long-term behavioral change 

Demonstrate regulatory compliance 

Ensure compliance with the organization’s internal policies 

Communicate IT risk policy to the participants