The overall objective of an organization should be to develop a security awareness program that permeates to all levels of the organization, and this is successful in promoting an effective: audit report governance strategy incident response plan O response to insider threat security culture