OPM outlines four steps for IT security training