There is a comprehensive training and education programme that yields measurable results. Responsibilities are clear, and process ownership is established. Training and education are components of employee career paths. Management supports and attends training and educational sessions. All employees receive ethical conduct and system security awareness training. All employees receive the appropriate level of system security practices training in protecting against harm from failures affecting availability, confidentiality and integrity. Management monitors compliance by constantly reviewing and updating the training and education programme and processes. Processes are under improvement and enforce best internal practices.