NO$\mathrm{.}79$ Which of the following is MOST important to ensure when developing an effective security awareness program?$($A$).$ Training personnel are information security professionals.$($B$).$ Phishing exercises are conducted post$-$training.$($C$).$ Security threat scenarios are included in the program content. $($D$).$ Outcome metrics for the program are established.