In short: Cyber Essentials staff training is not a requirement: the scheme assesses five technical controls (firewalls, secure configuration, security update management, user access control and malware protection) and has no staff awareness control. Training complements it by teaching people to use MFA properly, avoid unapproved software, apply updates and report problems, so the controls keep working between assessments.
What Cyber Essentials does and does not cover
Cyber Essentials is the government-backed scheme, run by the NCSC with IASME, that checks five technical controls against the NCSC's *Requirements for IT Infrastructure*, currently version 3.3, used with the Danzell question set since 27 April 2026. The controls are firewalls, secure configuration, security update management, user access control and malware protection.
There is no staff training or awareness control. You can pass Cyber Essentials, or Cyber Essentials Plus, without having trained anyone. That is deliberate: the scheme focuses on a small set of technical measures that block the most common internet-based attacks.
So if a tender, customer or insurer asks for both, they are asking for two different things. For the scheme itself, see Cyber Essentials requirements and the Cyber Essentials checklist on our specialist site.
Why training still matters for Cyber Essentials
The certificate is a snapshot, but the controls have to work every day. Under the Danzell rules, the board-level person who signs the declaration also accepts responsibility for keeping the organisation compliant for the year the certificate covers. Most of the ways an organisation drifts out of compliance involve people:
- Approving an unexpected MFA prompt, or asking IT to switch MFA off because it is inconvenient
- Installing unapproved apps or browser extensions on work devices
- Postponing updates and restarts for weeks
- Sharing an admin account, or using an admin account for email and browsing
- Ignoring or dismissing a malware warning
- Connecting a personal device to work services without telling anyone
Training will not replace the technical controls, but it reduces the everyday behaviour that quietly undoes them.
Mapping training to the five controls
We map short awareness topics to each control, so staff understand why the rules exist:
| Cyber Essentials control | What staff need to understand | Training topic |
|---|---|---|
| User access control | Why MFA matters, never approving prompts you did not start, and why admin rights are limited | Password and MFA training |
| User access control: password requirements | Long passphrases, password managers and never reusing work passwords | Password and MFA training |
| Security update management | Why updates and restarts should not be delayed | Core cyber security awareness training |
| Malware protection | Not overriding warnings, not running unknown files, and reporting odd behaviour | Ransomware awareness training |
| Secure configuration | Only using approved software and devices, and locking screens | Security for remote and hybrid workers |
| Firewalls | Not disabling protection on laptops at home or on public Wi-Fi | Security for remote and hybrid workers |
Under the Danzell question set, a cloud service without MFA switched on, where the provider offers it, is an automatic fail, which makes MFA one of the most valuable things to train people on.
Covering what Cyber Essentials leaves out
Cyber Essentials is not designed to stop attacks that work by persuading a person, such as:
- Phishing that tricks someone into entering a password on a fake login page; see phishing awareness training
- Invoice fraud and payment diversion, which needs no malware at all; see business email compromise training
- Social engineering by email, text or voice, including fake IT support; see social engineering training
- Data handling mistakes, such as emailing personal data to the wrong person; see GDPR training for staff
This is why the NCSC treats engagement and training as a separate area of its 10 Steps. See NCSC guidance on staff training.
Using both as evidence
Cyber Essentials and training records answer different questions, and together they make a stronger case to customers, insurers and auditors:
| Question | Cyber Essentials answers it? | Training records answer it? |
|---|---|---|
| Are basic technical controls in place? | Yes | No |
| Are staff trained to spot phishing and fraud? | No | Yes |
| Are people tested and improving? | No | Yes, with simulation trends |
| Have staff accepted our policies? | No | Yes, with policy acknowledgements |
The NCSC's cyber insurance guidance recommends having Cyber Essentials in place before you buy cover, and insurers often ask about training separately. See security awareness training for cyber insurance.
How we help
Forever Systems supports Cyber Essentials and Cyber Essentials Plus through our specialist site, and runs awareness programmes here. We can align the two: training topics that support your controls, a refresher before your renewal, and reports that sit alongside your certificate. Our managed security awareness training service runs it all year.
Contact us to combine training with your Cyber Essentials work.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Cyber Essentials require staff training?
No. Cyber Essentials assesses five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. There is no staff training or awareness control, although training helps you keep those controls in place.
Does Cyber Essentials Plus include phishing testing?
No. Cyber Essentials Plus adds hands-on technical testing of your systems, but it does not include phishing simulation or staff awareness testing. Those are run separately through a security awareness programme.
Is security awareness training worth it if we already have Cyber Essentials?
Yes. Cyber Essentials blocks many common technical attacks, but phishing, invoice fraud and social engineering target people. Training covers those gaps and helps staff use the controls properly.
Which training topics best support Cyber Essentials?
MFA and passwords, approved software and devices, updates and restarts, malware warnings and reporting. MFA is especially important because missing MFA on cloud services is an automatic fail under the current Danzell question set.