Now that entry has been gained, the responsible body has been appointed and has both found the starting point and planned the process, and that individual resistance has been dismantled, that organisational factors hindering and facili- tating the change have been considered, that security and protection standards or best practices have been determined, and the staff is trained, how can respect for security rules be improved?

The necessary conditions for the respect of security and rules plans are achieved through the following steps:

- Existence and development of an organisational security culture .

- Ownership of rules and of security plans.

Participation in their design and improvement process. Training to clarify and understand them. Persuasion of both their adequacy and effectiveness.

- Drawing up an agreement between the individual and the organisa- tion regarding compliance of security rules and plans.

- Regular intervention by the people responsible for security or infor- mation and training purposes, reminding the people of their recipro- cal agreements and collecting the opinions of people about the ade- quacy and effectiveness of the rules.

What can be done in cases of non-compliance by security rules and plans?

I - Find and solve the causes of the non-compliance (see chapter 2.2).

II - If the cause of non-compliance is intentional and depends merely on the will of one individual, the following steps may be taken:

a - Talk to the person (as the culmination of a previous process aimed at solving the causes of the non-compliance) in order to generate motivation and commitment.

b - Take the issue up with the relevant work team, in the pres- ence of the individual concerned (this step may sometimes not be adequate, depending on the situation)

c - Apply a warning system (between 2 and 3 warnings)

d - Apply a system of gradual sanctions which can culminate in firing the individual.

It is important to include in the agreement a clause referring to the compliance by the security rules and plans, so that all defenders are fully aware of the importance assigned to security by the organisation.