Employee security awareness should be promoted not only through trainings and exercises, but also through top management's example. Employees are more likely to treat PII security with due diligence if they are aware of the importance of PII security and the consequences for everyone else in the company.