The implementation of a Security Awareness Program (Requirement 12.6) requires that personnel must be educated upon hire and at least