While Security Awareness Training should be done every 4 to 6 months at a minimum, security testing should be every 6 to 12 months.