Which of the following should be included when training employees about data security:

A$.$ have employees sign a confidentiality and security standards agreement for handling sensitive data

B$.$ create a culture of security by having regular training updates

C$.$ ensure that employees know how to report suspicious activity

D$.$ all of the above