1.Talk to each concerned employee irrespective of designation, or skill sets to gauge level of awareness, attitude and execution. These can be three different things. High degree of technical skill sets, even in the domain of information security or know how, and irrespective of how responsible and knowledgeable a given individual may appear to be