The Chief Information Security Officer (CISO) proposed mandatory training for all employees in the organization, including those who do not work in traditional IT positions. The Chief Operations Officer (COO) is upset and argues that their staff should be excused from the training due to other time commitments. The CISO reminds the COO that many information security risks are related to the exploitation of human weakness in an organization, thus the training is important enough to be mandatory. Who is right