Many organizations are required to secure the systems and data they use in their daily operations, and, even if they are not required, they do so as part of a risk management strategy.

How can organizations increase compliance?

Is there one approach that works better than others?

Should the approach depend on whether the organization is seeking compliance with an internal policy or a regulation, like the GDPR or HIPAA, for example?

Are punitive measures, i.e. fines, an effective means of ensuring compliance?