An employee received an email impersonating the owner of the company. The employee followed the email's request and bought gift cards without verifying the legitimacy of the email. Due to this issue, the company decides to implement a new policy to mitigate this risk. What policy should the company implement? Select one: Patching Awareness training Compensating controls Configuration management