Agencies should fully understand how to embed information security into IT best practices and amongst all users to protect agency data.