An organization wants staff who can not only secure devices but also address the human element of protection, as reflected in the Security fundamentals objective. Which activity best aligns with a key element of a security program described in that objective?