Mechanisms exist to sanction personnel failing to comply with established security policies, standards and procedures.
Does the organization sanction personnel failing to comply with established security policies, standards and procedures?