Which of the following should be the PRIMARY focus of an IT risk awareness program? 

Answer options:

A. Cultivate long-term behavioral change
B. Demonstrate regulatory compliance
C. Ensure compliance with the organization`s internal policies
D. Communicate IT risk policy to the participants

A