(2) evaluating the effectiveness of the security program in communicatingpolicies, raising awareness levels, and reducing incidents.
The security program needs to be evaluated.
The security levels are too high at the moment.