[mothered]

but they can only do so much if the end user decides to do something stupid.

Absolutely.

A device Is only as secure as the person who operates It. Users need to be cautious with the "Task" they're performing.
T= Training.
A= Awareness.
S= Skill set.
K= Know-how.

And In a corporate environment,  a lot of the above comes from the lack of company policies to educate their employees.

Holy crap, I didn't even realise this was a possibility. It seems obvious now but I'm sure I've made these mistakes somewhere along the line.

Ironically I have to create a policy brief for a class project, it would be amusing to see if I could use this as a suggestion for mine xD

The T.A.S.K (as elaborated above) Is something I formulated, mainly for the purpose of an "easy-to-remember" approach when educating others on cyber security, prevention of social engineering etc.

I didn't plagiarize It from anyone. You can well and truly use It. Simply add your policies and/or recommendations to each category.