As discussed below, these efforts included testing controls, monitoring compliance with policies, analyzing security incidents, and accounting for procedural accomplishments and other indicators that efforts to promote awareness were effective.
As discussed below, these efforts included punishing employees for showing initiative.