The basic guideline that should be kept in mind during development of an information security training and awareness program is that the program needs to focus on creating in all employees an awareness that their company might be under attack at any time. They must learn that each employee plays a role in defending against any attempt to gain entry to computer systems or to steal sensitive data.