During this phase, the security awareness program becomes more developed and accepted in the organization. The strategic level begins to issue the policy and the procedures of the security awareness program. Basic training is provided to the organization's users on:

• Internet safety
• Cyber hygiene
• Organization policies
• Organizational procedures

At this point, users know what to do as well as what not to do. The security awareness maintains its capabilities by updating their material as required.