Yet even in smaller organizations, reasonable security programs are by definition complex, require awareness of good security practices, and require people to implement and monitor security processes.