In short: NCSC staff training guidance says people are a strength when properly engaged. Its 10 Steps recommend small, frequent, tailored training, a positive culture and easy reporting without blame. Its phishing guidance warns against punishing clicks and says to measure reports. Its free Top Tips for Staff e-learning is a good starting course.
10 Steps: engagement and training
The NCSC's 10 Steps to Cyber Security breaks security into ten areas for organisations, and one of them is engagement and training. Its core message is that people can be one of your most effective resources for preventing and detecting incidents, but only if they are properly engaged.
The guidance recommends:
- A positive security culture where people feel safe to speak up, led by senior leaders who follow the rules themselves
- Understanding how people really work, including the pressures and barriers they face, and giving them a route to challenge processes that do not work
- Clear reporting processes that people know about and are encouraged to use, with fair responses and staff involved in fixing problems
- No stigma for mistakes: incidents are opportunities to improve, so people are not reluctant to report next time
- Tailored training: work out the knowledge and behaviours you need before buying or building a course, and check that off-the-shelf content fits your controls
- Small, frequent sessions rather than one hour-long annual event, with content that changes from year to year
It also makes the point that awareness on its own does not change behaviour: if a technical or cultural barrier makes the secure option hard, fix the barrier too.
Phishing: what the NCSC says about simulations
The NCSC's phishing guidance describes four layers of defence: make it hard for attackers to reach users, help users identify and report phishing, protect the organisation from the phishing that gets through, and respond quickly. Training sits in the second layer, alongside making verification of sensitive requests, such as payments, a normal part of the process. The NCSC also says defences often lean too heavily on users: no training will teach everyone to spot every phishing email, so technical controls must carry much of the load.
On phishing simulation specifically, it advises:
- Check with HR first before running any simulation
- Do not punish clicks: blaming users does not work, and punishing people for clicking on messages you sent yourself starts to look like entrapment
- Measure reports, not only clicks, so success is recognised
- Avoid an "us versus them" dynamic; alternatives include having staff design their own phishing emails to learn the techniques attackers use
- Make reporting quick and give feedback, so staff become an early warning system, even after they have clicked
This is why we run simulations as a learning exercise, not a test people pass or fail. See building a positive security culture and how to report a phishing email.
Free NCSC training and toolkits
The NCSC publishes several free resources that make a good foundation:
| Resource | Who it is for | What it gives you |
|---|---|---|
| Top Tips for Staff | Non-technical staff, aimed mainly at small and medium businesses, charities and the voluntary sector | Short e-learning (under 30 minutes, no login for the web version) on phishing, passwords, securing devices and reporting incidents; also available as SCORM packages for your own learning system, in English and Welsh |
| Small Business Guide and Small Charity Guide | Owners and managers of small organisations | The technical and practical basics in plain English |
| Cyber Governance Code of Practice, Cyber Governance Training and the Cyber Security Toolkit for Boards | Directors, trustees and governors | What boards should do and how to oversee cyber risk; see cyber security training for board members |
| Exercise in a Box | Teams that want to rehearse incidents | Scenarios to practise your response to a cyber incident |
| Suspicious Email Reporting Service | Everyone | Forward suspicious emails to report@phishing.gov.uk and scam texts to 7726 |
Our page on free security awareness training explains how far these resources take you, and where a paid platform starts to earn its keep.
How a training platform builds on NCSC advice
The NCSC tells you what good looks like; a platform helps you do it every month without a big admin burden:
| NCSC recommendation | How a platform supports it |
|---|---|
| Small, frequent sessions | Scheduled micro-modules of a few minutes, sent automatically |
| Tailored to your organisation | Role-based content, custom courses and your own policies |
| Easy reporting | A report button in Outlook or Gmail that records every report |
| Measure reports, not only clicks | Dashboards showing report rate and time to report |
| No blame | Instant, private teaching moments instead of naming and shaming |
| Board oversight | Trend reports for leaders, linked to the Cyber Governance Code |
Several platforms we supply can host your own content, so you can run the NCSC course alongside their libraries. See choosing security awareness training software and how to measure training effectiveness.
How we help
We design programmes around the NCSC's principles: a baseline, short regular training, blame-free simulations agreed with HR, a one-click report route and reports that focus on reporting as well as clicks. We pick the right platform from the vendors we supply and run it for you through our managed security awareness training service.
Contact us to build an NCSC-aligned programme.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does the NCSC recommend phishing simulations?
The NCSC does not ban them, but it is cautious. It says to check with HR first, never to punish people for clicking, to measure reports as well as clicks and to remember that training cannot teach everyone to spot every phishing email. Run simulations as learning, not as a trap.
Is the NCSC Top Tips for Staff training free?
Yes. It is free, takes under 30 minutes and the web version needs no login. It covers phishing, passwords, securing devices and reporting incidents, and SCORM packages let you run it in your own learning system and record completions.
What are the NCSC 10 Steps to Cyber Security?
They are the NCSC's guidance for organisations, breaking cyber security into ten areas such as risk management, engagement and training, identity and access management, and incident management. The engagement and training step covers culture, reporting and how to train staff.
How often does the NCSC say staff should be trained?
The NCSC does not set a fixed frequency, but it recommends small, frequent sessions rather than a single annual event, and refreshing the content each year so it stays relevant.
Where should staff report a phishing email in the UK?
Internally first, through your report button or IT team. Suspicious emails can also be forwarded to the NCSC at report@phishing.gov.uk, and scam texts to 7726.