A key aspect of embedding an effective system is the rollout of interactive training sessions and “hazard hunts” – where cyber risks are identified through internal audit and corrective actions are implemented.