An effective employee security awareness program should clarify that everyone in the organization is responsible for IT security. It will also identify the steps that need to be taken if an incident or suspected incident arises. Users should be able to identify who to contact, details on the event that transpired, and who or what was involved in the incident.