A security awareness program is easiest to sustain when you treat it as an administrative routine rather than a campaign: a fixed calendar of short sessions, a written attendance record for each one, a schedule for refreshing the material, and a standing way to catch up anyone who joined between sessions. Decide the dates for a full year in one sitting, keep each session to twenty minutes on one specific topic, and record who attended and when.
This article is general information about process and recordkeeping. It is not legal, employment, compliance or security advice, and it covers the administration of the program only, not the content you choose to teach. Anything that touches employment terms, attendance as a condition of work, or what may be monitored belongs with an employment attorney and your organization’s HR advisors. Which obligations apply to you varies by organization, industry and jurisdiction.
Set the security awareness program calendar first
The scheduling decision is the one that determines whether the program survives its first quarter. Material can be improved later. A calendar that was never set cannot be.
Pick a cadence and put every date in the shared calendar for the next twelve months on the day you decide it. Three cadences work in practice:
- Quarterly, forty minutes. Four sessions a year. Lowest administrative load, longest gap between touchpoints.
- Monthly, fifteen to twenty minutes. Twelve short sessions. Highest continuity, and the easiest to keep specific because each session only has to carry one idea.
- Twice a year, plus short written notes in between. Two live sessions and a handful of one-paragraph written items. Suits organizations where getting everyone in a room is genuinely hard.
Monthly short sessions are the default worth starting with. A twenty-minute slot is easy to defend against a busy week, and the frequency means missing one is not a gap in anyone’s record for long.
Name a single owner for the calendar. The owner’s job is narrow: the dates exist, the room or call is booked, the attendance sheet gets filled in, and the record is filed. That is the whole role, and it should take a couple of hours a month.
Keep sessions short and specific
One topic per session, stated as a plain sentence, is the structural rule that keeps the material useful. “How we handle a request to change payment details” is a session. “Security best practices” is not; it is a title with no content attached, and it is the reason most sessions blur together.
A workable shape for a twenty-minute session:
- State the situation the session is about, in one sentence.
- Walk through what the organization’s process says to do in that situation.
- Name where the relevant document or route lives.
- Take questions, and write down any question you could not answer.
- Note any process gap the questions revealed.
Steps four and five are where the real value sits. Questions tell you which parts of your own documented process are unclear, and a session that produces three questions and one process fix has done more than one that produced polite nods.
Keep the register of topics simple: how access is requested and approved, what the acceptable use document says and where it is, how to report a concern, how equipment is handled when traveling or working away from the office, how to verify an unusual request through a known channel, and what happens during onboarding and departure. That is a year of monthly sessions without inventing anything.
This article does not cover simulated exercises or testing of individual people, and the program described here does not include them. Nothing in a security awareness program certifies or credentials anyone; it is internal familiarization with your own processes.
Record attendance for every security awareness program session
The attendance record is the program’s actual output. Without it you have held meetings; with it you have a program you can describe.
Keep one sheet per session with five fields and no more:
| Field | What it holds |
|---|---|
| Session date | The date it was actually held, not the date it was scheduled |
| Topic | The one-sentence topic, as delivered |
| Material version | Version number or date of the deck or notes used |
| Attendees | Names, marked present or absent |
| Owner | Who delivered it and who recorded attendance |
Record absences as well as attendance. A sheet that only lists who came cannot tell you who needs a catch-up, which is the one question the record exists to answer.
Store the sheets in one folder in date order, with the material used filed alongside. The pairing is what makes the record meaningful: an attendance list with no indication of what was covered tells you very little a year later.
The benefit of this is a clear, retrievable record of what was covered and who was there. It is not a claim that the sessions change outcomes, and it should not be described that way internally. Treat the record as documentation of a routine you run, which is what it is.
Refresh the material on a cadence
Set a review date on every piece of material and review the whole set once a year. Reviewing material is faster than writing it, so an annual pass over a year’s worth of short sessions is a half-day of work rather than a project.
Three events should pull a topic forward for an off-cycle refresh:
- A process the session describes has changed, which makes the existing material actively wrong.
- A tool or system named in the session has been replaced.
- Questions in a session revealed that the material explains something unclearly.
Write material that avoids naming specific products wherever you can, and describe the step instead. “Request the access through the route your manager approves” survives a tool change; a session built around one application’s screens has to be rewritten the week you switch.
Version every piece of material and keep superseded versions. The version number on the attendance sheet only means something if the version it points at still exists.
Cover the people who joined between sessions
This is the gap that quietly undoes otherwise well-run programs. Someone joins in week three of a quarter, the next session is ten weeks away, and nothing in the process notices.
Two mechanisms close it, and you want both:
- A standing catch-up item on the onboarding sheet. The new person is pointed at the most recent session’s material in their first week, and the onboarding sheet records the date they went through it and the version they saw. This puts them into the record immediately rather than at the next session.
- A monthly reconciliation. Once a month, compare the current staff list against the attendance sheets for the past twelve months. Anyone with no entry gets scheduled individually. This is a five-minute task that catches both new joiners and anyone who happened to be absent repeatedly.
Handle internal moves the same way. If someone changes role into work that touches a different system, the session on that system is worth repeating for them, recorded with its own date.
For people who cannot attend live at all, a short recorded or written version of the same material with an acknowledgment line is a reasonable substitute, as long as the acknowledgment lands in the same record with the same fields. One record format for everyone is what keeps the reconciliation possible.
Getting the first year of the security awareness program running
Decide the cadence today and put the dates in the calendar before you write a single slide. Write the first session from a process you already have documented, hold it, fill in the attendance sheet, and file it. That one complete cycle, with a dated sheet and the material beside it, is a real program; everything after it is repetition and gradual improvement.
Keep expectations plain in how you describe it internally. The program gives you a documented routine, a record of what was covered, and a steady channel for explaining your own processes to the people who have to follow them. That is a reasonable thing to aim at and a reasonable thing to report. For a twelve-month session calendar and a one-page attendance sheet you can copy, see the Free Resources page on this site.