(5) Executives and employees shall be provided with awareness and education program on the information security and act with the knowledge of its sensitive nature to ensure the proper implementation of the information security measures.