Run formal training at onboarding and at least yearly, then add short reminders every month or so and a hands on exercise each quarter for high risk roles. Regulators rarely fix a number. CISA recommends reinforcing habits often rather than once a year, and HIPAA's text says periodic.
What guidance gives you
HIPAA's Security Rule lists security reminders as periodic security updates, without stating a day count. CISA's advice for employees and phishing is to reinforce secure habits often rather than once a year. NIST SP 800-50 Rev. 1 treats the program as a lifecycle you review and adjust. None of these hands you a number, so you choose and document.
A cadence that works for a small team
- Before or at first access: Core onboarding; 20 to 30 minutes
- Monthly: A short note with one real example; 3 to 5 minutes
- Quarterly: Role exercise, such as a developer lab; 30 to 60 minutes
- Yearly: Refresher plus policy acknowledgement; 20 minutes
- Yearly: Tabletop for managers; 60 to 90 minutes
- After an incident: Targeted note to affected groups; 5 minutes
Event driven triggers
Calendars are not enough. Run a short session when something changes: a new tool rollout, a role change to admin access, a phishing wave that reaches inboxes, a policy update, or an incident at a similar company. Short and timely beats long and late.
Avoid fatigue
More frequent does not mean longer. People tune out when every week brings a course. Keep reminders tiny, varied, and tied to what they do. Retire topics that never produce a behavior change.
Decide, then write it down
Put the cadence in your awareness policy, assign an owner, and keep the calendar. A cadence on paper that nobody follows is worse than a modest one you meet. Auditors tend to sample both the policy and the records.
Who gets what
New hires need the full onboarding. Developers and administrators need extra role content. Executives need a short briefing on fraud and decision making. Contractors with access need the same baseline. The point is to match frequency to exposure.
Quick check
Is quarterly training necessary?
Not for everyone. Quarterly makes sense for high risk roles. For the general workforce, monthly micro reminders plus a yearly refresher is a common pattern.
What if we only do it once a year?
You may still meet a minimum requirement, but you give up the benefit of repetition. Add short reminders so the yearly session is not the only contact.
Sources
Last reviewed: 19 October 2026.
