One additional thing is that the punishments have to be realistic. If your policy is to fire someone who is lax in security, your managers are likely to cover u

One additional thing is that the punishments have to be realistic. If your policy is to fire someone who is lax in security, your managers are likely to cover up infractions so that they don't have to fire their employees. You have to be willing to follow through.