The Cybersecurity Employee Awareness Program was established in Written Information Security Program document, as well as quarterly training and monthly phishing test exercises with training and an escalation procedure for repeated failures.