The best programs contain a diverse set of awareness materials including print, email, and web-based content as well as face-to-face interaction with employees. Psychological damage would result from financial uncertainty or if the attack were launched on another sector in the critical infrastructure such as the electric grid, then psychological effects would be caused by a loss of confidence. The people evaluating the CISOs performance often have very little operational information security knowledge, according to the CISO. If the security operations personnel are allowed to select solutions, they will put forth a budget.”]
Source: https://www.csoonline.com/blog/the-brave-new-world-of-infosec/