Access controls (reviewing who has access to privileged information); awareness and training (Information Security Policy review; associate phishing campaigns; ongoing communication regarding good practices); empowering associates (see something, say something; to protect their digital life); formal quarterly communications sessions (how security and data privacy apply to all).