As discussed below , these efforts included testing controls , monitoring compliance with policies , analyzing security incidents , and accounting for procedural accomplishments and other indicators that efforts to promote awareness were effective .
As discussed below , these efforts included punishing employees for showing initiative .