The simplest course of action would be to hold a formal meeting where employees can ask questions and get clarification on items that may be confusing or too technical for the average person. Once everyone is on the same page, it’s critical that they agree to adhere to the security awareness policy. Accountability is crucial, so drafting a document that employees should sign would be the most straightforward approach. The document should be a no-nonsense agreement that simply states, “ I agree to adhere to said policy or be subject to disciplinary action up to and including termination.” At least that's the usual spiel. However you decide to word the agreement, you should stress the importance of information security and that employees can and should be proactive in helping to maintain a secure environment. After all, they have a vested interest. If someone's lax attitude results in the exploitation of sensitive customer information, your business could be slapped with a lawsuit. Then everybody loses their job...or worse. How do you look in an orange jumpsuit?
