Best practice is at least annually, and after significant changes such as rapid hiring, a restructure, or a real attempted attack. Regular testing keeps awareness sharp as attacker tactics evolve.