How often should the security awareness program be communicated to employees?

An effective security awareness program is not a one-time event but a continuous, iterative process. The goal is to build and sustain a security-conscious culture, which requires ongoing reinforcement. Continuous communication through multiple channels—such as regular newsletters, simulated phishing exercises, posters, and brief training modules—ensures that security remains a top-of-mind consideration for all employees. This approach is far more effective at influencing long-term behavior change than periodic, event-based training, which is often forgotten shortly after completion.

B. Annually: This frequency is insufficient for knowledge retention and treats security as a compliance task rather than an integral part of the organizational culture.

C. Monthly: While an improvement over annually, a rigid monthly schedule can be limiting and is less effective than a holistic, continuous program with varied touchpoints.

D. At orientation and review times: These are essential components of a program but are not frequent enough on their own to maintain a consistent level of security awareness.

---

1. National Institute of Standards and Technology (NIST). (2003). Special Publication 800-50, Building an Information Technology Security Awareness and Training Program.

Section 4.3, "Implementing the Awareness and Training Program," Page 21: The document explicitly states, "The awareness and training program is not a one-time event; it needs to be a continuous process to be effective... The program should use periodic security reminders (e.g., via e-mail), displaying posters, or distributing newsletters." This directly supports the concept of continuous communication.

2. SANS Institute. (2022). 2022 SANS Security Awareness Report: The Rising Era of Human Risk Management.

Section "Maturity Model," Pages 6-8: The report describes the most mature and effective security awareness programs as those that have moved beyond simple compliance-focused annual training. These high-maturity programs engage their workforce "continuously throughout the year" using a variety of communication methods to reinforce key behaviors and manage human risk effectively.

3. Puhakainen, P., & Siponen, M. (2010). Improving employees' compliance with information security policies: An empirical investigation. Proceedings of the 43rd Hawaii International Conference on System Sciences (HICSS).

DOI: https://doi.org/10.1109/HICSS.2010.345

Section 5, "Discussion," Page 8: The study's findings emphasize that information security awareness must be a "continuous process" and integrated into daily work. It argues that one-off or infrequent training sessions are inadequate for achieving lasting compliance with security policies.