An awareness activity: training, a phishing simulation, a communication push. The human layer of the control catalog; the directive controls it operationalizes live in governance.