Training regularly
Requiring strong passwords
Requiring multi-factor authentication
Monitoring for threats
Consider security beyond virtual security