Activities implemented to raise awareness and provide training are not always as successful as hoped. This may be due to:
• lack of management support
• unclear objectives
• poor planning
• lack of performance monitoring
• lack of continuity
• insufficient financial or staffing resources
If no appropriate measures are taken to ensure the success of the training activities implemented, it is often not possible to achieve their objectives. If an organisation does not implement sufficient activities to ensure employee awareness and training, aspects of information security can be put at risk, which directly hinders the fulfilment of tasks.