mnli premise: As discussed below, these efforts included testing controls, monitoring compliance with policies, analyzing security incidents, and accounting for procedural accomplishments and other indicators that efforts to promote awareness were effective. hypothesis: As discussed below, these efforts included punishing employees for showing initiative.