A good program should include awareness about; data, network use, conduct, social media, personal devices, protecting company devices, phishing emails, social engineering tactics, types of viruses, and malware. Employees should also be trained in what information they can share, what information they should not transmit over the phone, and how to verify that the caller or email originator is authorized to receive the requested information.