Security standards help to create security policies but they are often very descriptive, especially when they are about security awareness. Information systems security awareness is vital to maintain a high level of security. SETA programmes (Security Education, Training and Awareness) increase information systems security awareness and play an important role in finding the strategic balance between prevention paradigm and response paradigm. By reviewing the literature, we identify guidelines to design a SETA programme following a PDCA (Plan Do Check Adjust) cycle.