Cyberpediaby Brain
ENDEFR

Lasting memory: spaced repetition and quizzes

Why training seen only once is not enough, and what NIST, ENISA and the NCSC say about continuous awareness.

In 30 seconds

Where it happens
In any awareness programme, whether it fits into one annual session or into short, regular reminders.
What the agencies say
A learning programme is designed as a cycle of continuous improvement1.
The reflex
Go back to the short reminders when they arrive, answer quizzes without looking up the answer, and report a suspicious message rather than ignore it.
If it is already done
A session taken in the past does not replace the reminders. ENISA and CISA run campaigns in October, and CISA offers a toolkit for 202623.

What it is

Cybersecurity training taken only once leaves few traces if nothing reminds people of it afterwards. This entry covers three methods for making good reflexes last: reminders spaced over time, questions that force people to retrieve the answer from memory (the quiz), and exercises close to real work.

This entry relies on agency texts: NIST, ENISA, CISA and the NCSC. These texts discuss continuous programmes, culture and behaviour. None of the documents read describes how memory works, or measures forgetting after a single session. The entry therefore sticks to what the agencies write, and flags what they do not say.

Straight answers

Why is training seen only once forgotten?

The sources cited here do not answer this question. They contain no measurement of forgetting and no study of memory. What they show is indirect: the agencies design awareness as a lasting process. In its draft guidelines, NIST presents a lifecycle model « that allows for ongoing, iterative improvements », that is, continuous and repeated improvements1.

What are spaced repetition, the quiz and the scenario exercise?

Spaced repetition means going over a topic at intervals, for example a few minutes each time. The quiz asks people to retrieve the answer instead of rereading it. The scenario exercise puts the employee in front of a case close to their work. These three methods are not named in the sources cited here: they serve here as a grid for reading the agencies' recommendations, without attributing to them opinions they do not express.

What does this change for me compared with an annual session?

An annual session happens once, on a fixed date. Short reminders come back throughout the year. The agencies do organise repeated moments: October is European Cybersecurity Month, run by ENISA and the European Commission2, and October is also Cybersecurity Awareness Month in the United States, with four basic actions within everyone's reach3.

What is said about an employee who does not know their responsibilities?

NIST writes in a 2013 draft that every person who owns, uses, relies on or manages information « must fully understand their specific security responsibilities »4. This text is a draft of role-based training, since replaced by a later version4.

1What it changes for employees1 min

For an employee, the change concerns frequency and form. Instead of one long module taken once, a programme designed as a cycle provides for regular returns. NIST describes its approach as a model that allows changes « to accommodate cybersecurity, privacy, and organization-specific events », in other words one that adapts to events specific to the organisation1.

The agencies also stress habits. ENISA runs campaigns to promote good practices and behaviour change, with improving cyber hygiene as the central focus: giving people « the knowledge and habits » needed to spot and reduce everyday risks2.

CISA highlights one specific action: among four basic actions, avoiding and reporting phishing messages3. The UK NCSC states that reporting a scam message is free and takes a minute5. It specifies that reporting helps reduce the number of scam messages received and protects others5.

2What it changes for managementManagement1 min

For management, the texts read discuss programme, cycle and measurement. The NIST draft sets among its objectives to integrate learning programmes into the organisation's goals for managing risk, to offer an employee-centred cybersecurity culture, and to address the difficulty of measuring the effect of programmes1. It also proposes indicators and evaluation methods so that the programme is improved regularly1.

ENISA, for its part, aims for an ecosystem where good cyber hygiene is « embedded as a standard practice » in all sectors2. It publishes tools for organisations, including an updated version of « Awareness Raising in a Box », released on 10 April 20242. CISA provides a toolkit so that organisations can build their own campaigns3.

A 2019 ENISA report deals with the human aspects of cybersecurity, in psychology, sociology, anthropology and behavioural economics among others6.

3What the text saysOfficial text1 min

None of the sources cited here is a binding legal text on spaced repetition, the quiz or the scenario exercise. They are guidelines, campaign pages and reports.

The NIST SP 800-50 Rev. 1 draft, published on 28 August 2023, aims to help US federal agencies and other organisations build a cybersecurity and privacy learning program using a lifecycle approach1. It is addressed to large and small organisations, and to varied audiences of employees1. The initial version of this guide dates from 20031.

NIST SP 800-16 Rev. 1, in its second working draft of October 2013, describes a role-based training method for staff with significant responsibilities in information security4.

On the European side, ENISA explains that its campaigns aim at behaviour and culture change2. An ENISA report on cybersecurity skills, published on 24 November 2021, analyses the supply of skills in Europe and the policies of member states to strengthen their workforces7.

4Where implementation stands1 min

The 2023 NIST SP 800-50 Rev. 1 draft has been replaced: the page states that it became obsolete on 12 September 2024 with the final version1. The public comment period is closed1. The content of the final version is not in the sources cited here. As for NIST SP 800-16 Rev. 1, the second working draft has been obsolete since 14 March 2014, replaced by a third4.

For NIS 2, the sources cited here give neither the state of implementation nor training obligations. Only one piece of information comes close: the ENISA page mentions a document dated 26 June 2025, prepared under Articles 6 and 10 of the Cybersecurity Act, on the skills and roles of the cybersecurity professionals needed by NIS 2 essential and important entities7. The text of this document was not read. It does not allow the claim that NIS 2 requires spaced reminders, quizzes or scenario exercises.

Finally, the NCSC publishes totals: in September 2026, more than 59.6 million reports received, and 263.7 thousand scams removed across 466,300 addresses5.

Fact sheet

Identifier
CP-389
Wing
6. Governance and GRC
Brain skill
Learning with BRAIN (learn_with_brain)
Brain reflex
air-009
Diagram
G2 · Visual vs Technical Indicators
Languages
de, en, fr
Sources
7 sources checked on 3 November 2026
Sources7 sources
  1. NIST, “Building a Cybersecurity and Privacy Learning Program”, 28 August 2023. https://csrc.nist.gov/pubs/sp/800/50/r1/ipd (accessed 3 November 2026)
  2. ENISA, “Awareness and Cyber Hygiene”. https://www.enisa.europa.eu/topics/awareness-and-cyber-hygiene (accessed 3 November 2026)
  3. CISA, “Cybersecurity Awareness Month”. https://www.cisa.gov/cybersecurity-awareness-month (accessed 3 November 2026)
  4. NIST, “A Role-Based Model for Federal Information Technology/Cybersecurity Training”. https://csrc.nist.gov/pubs/sp/800/16/r1/2pd (accessed 3 November 2026)
  5. NCSC (UK), “Phishing scams: how to spot and report them”, 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026)
  6. ENISA, “Cybersecurity Culture Guidelines: Behavioural Aspects of Cybersecurity”, 16 April 2019. https://www.enisa.europa.eu/publications/cybersecurity-culture-guidelines-behavioural-aspects-of-cybersecurity (accessed 3 November 2026)
  7. ENISA, “Addressing Skills Shortage and Gap Through Higher Education”, 24 November 2021. https://www.enisa.europa.eu/publications/addressing-skills-shortage-and-gap-through-higher-education (accessed 3 November 2026)

Cite this article

Brain, “Lasting memory: spaced repetition and quizzes”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/lasting-memory-spaced-repetition-quizzes/

BibTeX 
@misc{brain_cp389_en_2026,
  author = {Brain},
  title = {Lasting memory: spaced repetition and quizzes},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/lasting-memory-spaced-repetition-quizzes/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence