Users have read and agreed to comply with security policies.

Risk issues are openly discussed within the organization.

Scores have improved on risk awareness quizzes.

There is a decrease in the number of reported incidents.