Assessing Security Awareness and Knowledge of Policy