Security standards help to create security policies, but they are often very descriptive, especially when it comes to security aware- ness. Information systems security awareness is vital to maintain a high level of security. SETA programmes (Security Education, Training and Awareness) increase information systems security awareness and play an important role in finding the strategic balance between the preven- tion and response paradigms. By reviewing the literature, we identify guidelines for designing a SETA programme following a PDCA (Plan Do Check Adjust) cycle.