Emphasize that everyone in an organization needs to be trained and aware of information security, but not every member of the organization needs a formal degree or certificate in information security.
Discuss that when formal education for appropriate individuals in security is needed, with the support of management, an employee can identify curriculum available from local institutions of higher learning or continuing education.