An effective time frame
Winkler and Manke say while most security awareness programs follow a one-year plan, those plans also attempt to cover one topic a month. They recommend a 90-Day plan – which reevaluates the program and its goals every three months.
"The most successful program focuses on three topics simultaneously that are reinforced regularly throughout the 90 Days. Every 90 days, the program is reevaluated to determine what topics need to be addressed moving forward."