All users should be trained in identifying and reporting suspicious activities from external and internal