- “Develop specific policies and procedures regarding the handling of proprietary or sensitive information.
- Improve information security training.
- Ensure only the minimum necessary access to the information.
- Communicate and apply consistent sanctions for information privacy or security violations.
- Monitor employee activity.
- Ensure adequate oversight or governance of information security programs.”