Educating employees and other users about current information security risks and helping to ensure consistent understanding and administration of policies through help-line telephone numbers, presentations to business units, and written information communicated electronically or through paper memos.
Keeping employees in the dark about how administration policies work and what information security risks are.