What can influence the effectiveness of a training program? What are some of the various ways to implement an awareness program?
Which two NIST documents largely determine the shape of an InfoSec program? Which other documents can assist in this effort?