The user community should be educated and trained so that they can embrace the security culture. There should be sufficient user awareness of security issues so that behavior of users is compliant with security policies