Company management is concerned that phishing scams might target its employees and hires a consultant to propose a control activity to mitigate the threat. Which control would most likely be proposed by the consultant?

Conduct penetration testing on information systems or individual system components to identify vulnerabilities that could be exploited by adversaries.

Control physical access to information system distribution and transmission lines with company facilities using security safeguards.

Implement a program to train employees to carefully read incoming communications.

Encourage employees to protect sensitive information by destroying unneeded documents.