Ann, a company's security officer, often receives reports of unauthorized personnel having access codes to the cipher locks of secure areas in the building. Ann should immediately implement which of t

An Acceptable Use Policy defines permissible use of IT resources and does not directly address the behavioral issue of employees sharing physical cipher lock codes.

Installing new physical security controls such as replacement locks does not resolve the underlying behavior of employees sharing existing access codes with unauthorized individuals.

Technical controls operate on systems and software and cannot prevent employees from verbally disclosing physical cipher lock combinations to others.

The root cause of access codes being known by unauthorized personnel is that employees are either unaware of or disregarding security policies for protecting physical access credentials. Security awareness training directly addresses this by educating staff on the importance of keeping codes confidential, recognizing social engineering, and understanding consequences of policy violations. This targets the human-factor vulnerability that no technical or physical control can fully substitute for.