A training and education programme is instituted and communicated, and employees and managers identify and document training needs. Training and education processes are standardised and documented. Budgets, resources, facilities and trainers are being established to support the training and education programme. Formal classes are given to employees on ethical conduct and system security awareness and practices. Most training and education processes are monitored, but not all deviations are likely to be detected by management. Analysis of training and education problems is only occasionally applied.