Watch this video on YouTube
What is the first step to create an internal culture that emphasizes information security?