The results of such an evaluation should help identify and correct problems. Explaining what happens to an organization, its mission, customers, and employees if security fails, motivates people to take security more seriously. Awareness must be used to reinforce the fact that security supports the mission of the organization, by protecting valuable resources. If employees view security as just bothersome rules and procedures, they are more likely to ignore them. In addition, they may not make needed suggestions about improving security, nor recognize and report security threats and vulnerabilities.
Awareness can take on different forms for particular audiences.
Appropriate awareness for management officials might stress management's pivotal role in establishing organizational attitudes toward security. Appropriate awareness for other groups, such as system programmers or information analysts, should address the need for security as it relates to their job. Note that contractor employees are required to receive the same level of automated information systems security awareness as federal employees. Hence security awareness requirements should be included, as appropriate, in all DOT contracts. Remember, in today's systems environment, almost everyone in an organization may have access to system resources, and therefore may have the potential to cause harm.