The onus of protecting personal information sits squarely on the data owners head. Security should be a top down initiative and one of the highest corporate priorities. Security is not just a one time event, but a multi-level and multi-layered approach to protecting not only the network, but the systems, data, and access to such. It is management’s responsibility to develop and mandate security policies, so that secure processes and procedures must be in place before systems go live.”]
Source: https://www.cuinfosecurity.com/are-your-employees-your-biggest-security-concern-a-321