Security incidents must have serious consequences for the people who are responsible to keep everybody alert and engaged

Have read team vs blue team exercises once a year

Organise regular table top exercises

Run periodic awareness campaigns