Cyber Security Awareness
Make safer decisions about messages, accounts, devices and work information. Learn how to check unusual requests and report concerns promptly.
- 5 lessons and a final assessment
- Around 33–40 minutes
What you’ll be able to do
After completing the course, you should be able to:
- Recognise suspicious requests and choose an independent, trusted way to verify them.
- Choose safe authentication actions, including responding to an unexpected approval request.
- Choose appropriate actions for device security, updates, software and lost equipment.
- Choose approved ways to access, store and share work information.
- Report suspected incidents and mistakes promptly through the organisation's reporting process.
Lessons
Practice activities aren’t scored. You’ll see an explanation after each one.
-
Lesson 1
Check the request
Recognise suspicious requests and choose an independent, trusted way to verify them.
Not started, 0 of 4 steps complete -
Lesson 2
Protect your account
Choose safe authentication actions, including responding to an unexpected approval request.
Not started, 0 of 3 steps complete -
Lesson 3
Keep your device secure
Choose appropriate actions for device security, updates, software and lost equipment.
Not available yet -
Lesson 4
Share information safely
Choose approved ways to access, store and share work information.
Not available yet -
Lesson 5
Report it promptly
Report suspected incidents and mistakes promptly through the organisation's reporting process.
Not available yet -
After all five lessons
Final assessment
Ten questions, once every lesson is complete.
Not available yet
Legal context and references
The legislation and guidance behind this course. Sources checked 18 October 2026.
Legal context
- UK GDPR: security and accountability Article 5(1)(f), Article 5(2)
Personal information needs appropriate security against unauthorised use, loss and damage. The controller must demonstrate compliance with these principles.
Read Article 5 on legislation.gov.uk(opens in a new tab) - UK GDPR: organisational responsibility Article 24(1), Article 24(2)
The controller must implement appropriate technical and organisational measures, review them when necessary and adopt proportionate policies.
Read Article 24 on legislation.gov.uk(opens in a new tab) - UK GDPR: security of processing Article 32(1), Article 32(4)
Security measures must reflect the risk. Controllers and processors must take steps so people with access process personal information only on authorised instructions, unless domestic law requires otherwise.
Read Article 32 on legislation.gov.uk(opens in a new tab) - Data Protection Act 2018: unlawful use of personal information Section 170
Knowingly or recklessly obtaining, disclosing, procuring disclosure of or retaining personal data without the controller's consent can be an offence. Statutory defences apply. An accidental error is not automatically this offence.
Read Section 170 on legislation.gov.uk(opens in a new tab)
These provisions provide legal context. They do not prescribe this course, a fixed duration, annual renewal or an assessment pass mark. Completion supports training evidence but does not establish legal compliance or award Cyber Essentials certification. NCSC and ICO guidance is separate from legislation.
References and further reading
- NCSC: Top Tips for Staff(opens in a new tab)
- NCSC: Phishing attacks, defending your organisation(opens in a new tab)
- NCSC: How to spot a scam email, text message or call(opens in a new tab)
- NCSC: Business payment fraud(opens in a new tab)
- NCSC: Cyber Essentials requirements and resources(opens in a new tab)
- ICO: A guide to data security(opens in a new tab)