1. Security leadership
2. Positive work environment
3. Security training
5. Staff vigilance
6. Reporting and incident response
7. Information security
8. Measure your effectiveness