Can include having designated employees responsible for security, training, staff education, and having a system for evaluating effectiveness of security measures.