If users always behaved prudently, most of the IS tools would become unnecessary. We have to take into account the human factor, which can only be minimized through awareness. We implement the IS policy by means of training with tests, as in coursera. Otherwise, the policy becomes a stillborn document that is signed without being ever looked at and that is perceived by employees as a red-tape formality.