(2) evaluating the effectiveness of the security program in communicatingpolicies, raising awareness levels, and reducing incidents.
The security program needs to be evaluated.