Cyber Security Awareness Training: A Guide for UK Employers

Cyber security awareness training teaches staff to recognise the attacks that target people rather than systems, and to respond correctly when one gets through. It sits in an unusual position among compliance topics. No single law directly mandates it for most UK businesses, and there is no threshold below which you are automatically exempt. Yet for a growing number of employers the question is no longer whether to provide it, but what it needs to cover and how to prove it happened.

The pressure comes from three directions: UK GDPR accountability obligations, cyber insurance underwriting requirements, and the Cyber Essentials scheme. This guide covers what each of those means in practice, who needs training and at what depth, what a course should include, how often it should be refreshed, and what a defensible record of completion looks like.

For the wider picture, read our guide to compliance training for UK small businesses.

Is cyber security awareness training a legal requirement?

Not directly, and that is the honest answer. UK GDPR does not name cyber security awareness training as a requirement. What Article 32 requires is that organisations implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing personal data. Staff training is consistently treated by the Information Commissioner’s Office as one of those organisational measures.

The practical consequence arrives after an incident rather than before one. When the ICO investigates a personal data breach, it examines whether staff were adequately trained as part of assessing whether the organisation took appropriate measures. Breaches caused by phishing, misdirected emails, weak passwords, or accidental disclosure are among the most common categories reported, and all of them are at least partly addressable through training. An organisation that cannot demonstrate training was in place will find that a significant factor in any enforcement action.

So the obligation is real but indirect. You are not required to train. You are required to take appropriate measures, and after something goes wrong you will be asked what those measures were.

The other three drivers: insurance, certification, and your customers

Cyber insurance underwriters have tightened their requirements substantially as ransomware and phishing attacks on smaller businesses have increased. Many standard policies now include documented staff awareness training as a condition of cover. A business that suffers an incident and cannot evidence that training was in place may find its claim challenged or its policy voided, which is a materially worse outcome than the incident itself.

The Cyber Essentials scheme, owned by the National Cyber Security Centre and delivered through its certification partner, is a government-backed certification demonstrating a baseline level of cyber hygiene. Cyber Essentials does not formally require staff training. The controls it covers, including secure configuration, access control, and malware protection, are significantly harder to maintain without a workforce that understands why they matter, so training complements the technical requirements rather than substituting for them.

The third driver is the one that catches smaller businesses out, and it works the same way modern slavery requirements do. Larger organisations increasingly push security requirements down their supply chains, and a supplier questionnaire asking whether you provide security awareness training to staff is now routine in procurement. Answering no, or answering yes without evidence, costs contracts. If you supply the public sector, financial services, or anyone operating critical infrastructure, expect the question.

Who needs cyber security awareness training?

Everyone with an email address, at a baseline, because email is where most attacks arrive. Beyond that, four groups warrant more than the general course, and they are worth identifying because attackers identify them too.

Anyone who can move money. Finance staff, bookkeepers, and anyone with authority to change payment details or approve invoices are the direct target of business email compromise and invoice fraud, which is among the most costly attack types for smaller businesses. Their training needs to cover verification procedures rather than general awareness: what to do when a supplier emails new bank details, and why a phone call to a known number is the control.

Anyone with administrative privileges. IT administrators, and in a smaller business often whoever happens to manage the systems alongside another job, hold credentials that turn a minor compromise into a serious one.

Senior staff and directors. Executives are specifically targeted because they have authority, they are publicly identifiable, and they are often the least willing to sit through training. Attacks impersonating a chief executive to a finance assistant remain common because they work.

Remote and hybrid workers, and anyone using their own device for work. The controls that protect an office network do not travel, and the risks around home networks, personal devices, and shared spaces need covering explicitly.

What cyber security awareness training should cover

Effective training does not need to be technically complex. Its purpose is to help employees avoid the most common attack routes and respond appropriately when something goes wrong. The core topics are:

• Phishing and social engineering: recognising phishing emails, smishing, and phone-based attempts; what to do when a suspicious message arrives; and why links and attachments from unknown sources create risk.
• Password hygiene: strong unique passwords and the practical use of password managers; why reusing passwords across work and personal accounts creates risk; and the value of multi-factor authentication.
• Safe handling of data: handling sensitive data securely, including the risks of personal email and unsecured file-sharing, appropriate use of company systems, and the basics of encryption.
• Remote and hybrid working risks: public Wi-Fi, personal devices, and using a VPN where one is provided.
• Incident reporting: what constitutes a reportable incident, how to report a suspected breach internally, and why prompt reporting matters. Certain personal data breaches must be reported to the ICO within 72 hours of the organisation becoming aware of them.
• Device and software security: keeping devices and software updated, why updates matter, and the rules on installing unapproved applications on work devices.

Two areas deserve attention in any course written recently, because they are where the threat has moved fastest. The first is AI-assisted attacks. The spelling and grammar errors that used to make a phishing email obvious have largely gone, and voice and video impersonation is now cheap enough to be used against ordinary businesses rather than only high-value targets. Training that still teaches people to look for bad English is teaching an obsolete signal, and the replacement lesson is procedural: verify unusual requests through a separate channel, regardless of how convincing the message looks.

The second is authentication fatigue. As multi-factor authentication has become standard, attackers have adapted by repeatedly triggering approval prompts until someone accepts one to make it stop. Staff need to know that an unexpected prompt is a signal that someone has their password, and that the correct response is to report it rather than approve it.

This breadth does not require a long course. Well-designed training can cover all of it in under an hour, and scenario-based content retains better than passive reading. The goal is behavioural change rather than technical knowledge for its own sake.

SkillsCircle includes a cyber security awareness course as part of its pre-loaded compliance catalogue. Compliance Pathways deliver training from a single platform, with auto-provisioning, completion tracking, automatic renewal notifications, and reporting dashboards, so the annual refresh happens without anyone having to remember to chase it. See what’s included.

How often should cyber security awareness training be refreshed?

Annual refresh is the standard expectation, and it is what most cyber insurance policies and ICO guidance point toward. The threat landscape changes quickly enough that training completed three or four years ago is likely to be materially out of date, particularly on phishing, which has become far more convincing with the wider availability of AI-assisted content generation.

New starters should complete training at induction regardless of where they fall in the annual cycle. Following a significant incident or near miss, such as a successful phishing attempt, a misdirected email containing personal data, or a ransomware attack, additional targeted training is appropriate and demonstrates to the ICO that the organisation took the incident seriously.

Many organisations supplement the annual course with periodic phishing simulations, which produce a different and more useful signal than completion records: they show whether the training changed behaviour. If you run them, treat the results as a training input rather than a disciplinary one, because a workforce that fears the consequences of failing a simulation becomes a workforce that does not report real incidents.

Certification and what a completion record proves

A certificate evidences that a named individual completed a defined course on a specific date, and where assessment is included, that they met the pass threshold. For an insurance question or a supplier questionnaire, that is usually what is being asked for.

What it does not establish is that the person will behave differently under pressure, or that the training content was adequate for your particular risk. CPD certification indicates the course has been reviewed against continuing professional development standards for structure and learning value. It is a quality signal about the course rather than a statement that it satisfies any legal duty, and no accreditation body can make that guarantee on your behalf.

Certificates are necessary rather than sufficient. Keep them, keep them retrievable, and keep alongside them a note of why the training you chose was appropriate to your risk.

What a defensible record looks like

For training to serve its purpose in an ICO investigation or an insurance claim, the record needs to show more than that training generally takes place. It needs to show that a specific employee completed specific training on a specific date.

That means individual-level completion records with timestamps rather than a sign-in sheet from a team briefing. It means certificates or confirmations that can be retrieved quickly under pressure. And it means renewal tracking that flags when a refresh is due rather than relying on someone to remember.

For businesses managing this through spreadsheets or email threads, producing that evidence retrospectively after an incident is harder than it sounds. The records that matter most are the ones that were kept before anything went wrong.

Cyber security training for small businesses: why the exposure is different

Smaller businesses are not targeted less than large ones. They are targeted more indiscriminately, because most attacks are automated and do not care who they reach. What differs is the consequence. A large organisation absorbs an incident with an incident response team and a communications function. A business of thirty people absorbs it with the same people who were already doing everything else.

The second difference is the insurance one. A large organisation with a challenged claim has a legal team. A small business with a voided policy has an uninsured loss, and cyber losses for smaller businesses are frequently existential rather than merely expensive.

The response is not to replicate a corporate security programme. It is to do a small number of things well: train everyone annually, train the finance and admin roles more thoroughly, keep individual completion records, and be able to produce them quickly.

What is changing: the Cyber Security and Resilience Bill

The Cyber Security and Resilience (Network and Information Systems) Bill is currently before Parliament, having completed its Commons stages, with Royal Assent expected in late 2026 and phased implementation running toward 2028. It amends the Network and Information Systems Regulations 2018.

For most smaller businesses this is not a direct compliance deadline, and it would be misleading to present it as one. The Bill is aimed at critical national infrastructure, operators of essential services, digital service providers, managed service providers, and data centres. If you are a thirty-person business outside those categories, it does not place obligations on you.

It is worth watching for one reason. Regimes of this kind reach smaller businesses through the supply chain rather than through direct regulation, in the same way that modern slavery reporting duties reach businesses well below the turnover threshold. As organisations in scope tighten their own arrangements, the questions they ask suppliers get more detailed. If you supply anyone in those sectors, expect security questionnaires to become harder over the next two years rather than easier.

How SkillsCircle helps

SkillsCircle is a ready-made LMS for businesses with fewer than 200 employees. Its pre-loaded compliance catalogue includes a cyber security awareness course alongside health and safety, equality and diversity, data protection, and modern slavery training. There is no content to build and no specialist resource required. Staff complete courses online, individual completion records and certificates are generated automatically, and renewal dates are tracked within the platform, with reminders and follow-up chasers sent as deadlines approach.

Pricing starts from £8 per user per month with no setup costs. You can browse the compliance course catalogue, find out more about SkillsCircle, or book a demo.

Price excludes VAT and is on the first tier of graduated pricing. Cost per user reduces as more licences are purchased.