In short: Security awareness training for the public sector gives council, housing and public body staff the habits that stop phishing, payment fraud and data loss, with role-based modules for front-line, finance, housing, care and IT teams and for elected members. It supports Cyber Assessment Framework principle B6 and produces evidence for audit committees and assurance.
Why public bodies are a target
Public sector organisations are open by design. Staff names, roles and email addresses are published, services are delivered to anyone who asks, and money flows to hundreds of suppliers. Attackers use that openness:
- Supplier and payment fraud: fake requests to change a contractor's bank details, or invoices that look like they come from a known supplier; see business email compromise training
- Impersonation of residents and tenants: callers or emailers pretending to be a resident to change contact details or get information about someone else
- Credential phishing: fake Microsoft 365 sign-in pages, shared-document lures and fake IT messages aimed at staff whose addresses are easy to find
- Social engineering of the service desk: callers posing as staff to get a password or MFA reset; see help desk social engineering training
- Ransomware that starts with a click or a stolen password and disrupts statutory services; see ransomware awareness training
- Data handling mistakes: sending sensitive case information to the wrong recipient or sharing a link too widely
Training will not remove these risks on its own, but it turns staff into an early-warning system. A quick report of a suspicious message lets your IT team block it before others are caught.
The Cyber Assessment Framework and government expectations
There is no single law that says every public body must run a particular course. The expectation comes from the frameworks public bodies are measured against:
| Source | What it says about people | How training helps |
|---|---|---|
| NCSC Cyber Assessment Framework (CAF) v4.0, published August 2025 | Objective B, 'Protecting against cyber attack', includes principle B6, 'Staff awareness and training' | Records of training, simulations and reporting give evidence for B6 in a CAF self-assessment |
| Government Cyber Action Plan (DSIT, January 2026) | Sets measurable cyber objectives and outcomes for government organisations | Shows that the people side of cyber risk is being managed and measured |
| NCSC public sector guidance | Points public bodies to staff training, including the Top Tips for Staff e-learning (which can be completed online or added to your own training platform), and to the free Exercise in a Box for practising incident response | A platform builds on these free resources with regular modules, simulations and records |
| UK GDPR | Expects appropriate technical and organisational measures for personal data | Staff data protection training is one of those measures; see GDPR training for staff |
The NCSC designed the CAF for organisations that play a vital role in the day-to-day life of the UK, such as operators of essential services, and lists public sector bodies among its intended users. Many public bodies that are not formally assessed against it still use it as a reference model for their own assurance. Our NCSC guidance on staff training page explains the NCSC's wider advice, and is security awareness training a legal requirement? covers the legal picture. This page is general information, not legal advice.
Role-based training for public services
Every member of staff needs the core habits on our cyber security awareness training page. Then add depth for the roles attackers aim at:
| Team | Typical threats | Extra focus |
|---|---|---|
| Contact centre and front-line services | Callers impersonating residents, requests for someone else's information | Identity checks before sharing or changing anything; see social engineering training |
| Finance, payments and procurement | Supplier bank-detail changes, fake invoices, urgent 'director' payment requests | Call-back verification on a known number and dual authorisation |
| Housing and tenancy teams | Tenant impersonation, fraudulent requests to change rent or contact details | Verification procedures and careful handling of tenant records |
| Social care and safeguarding | Phishing aimed at case workers, misdirected emails containing special category data | Secure sharing, checking recipients and reporting a mistake quickly |
| IT and service desk | Password and MFA reset requests from fake staff | Strict identity verification for resets and privileged access |
| Senior officers, board members and elected members | Spear phishing, impersonation, deepfake voice or video requests | Targeted simulations and governance; see cyber security training for board members |
Elected members and board members are often the hardest group to reach. They may use a mix of organisation and personal devices and have limited time, so short, focused sessions work better than long modules. Most platforms let you assign content by group from Microsoft Entra ID or Google Workspace, so each team gets the right modules automatically.
Buying training through public procurement
The Procurement Act 2023 has applied to new public procurements since 24 February 2025. Many public bodies buy security services through an existing framework; others run a quotation process under their own thresholds. Whichever route you use, a clear specification makes the choice easier. Things worth including:
- User sync with Microsoft Entra ID or Google Workspace, so starters and leavers are handled automatically
- Where data is held and how the vendor processes staff personal data; ask for the data processing terms early
- Accessibility: captions, transcripts, keyboard navigation and screen reader support, so every member of staff can complete the training
- Phishing simulation with a report button, so you measure reporting and not only clicks; see phishing simulation
- Reporting suitable for an audit committee: completion by directorate, report rate and trends
- Multi-tenant management if you run shared services for partner organisations
- Users without a mailbox, such as some care, depot or seasonal staff, and how they will be trained
- Policy acknowledgement, so staff confirm they have read acceptable use and information security policies
Our checklist for security awareness training software covers each feature in more detail. Tell us your procurement route and we will supply the information your process needs.
Platforms that suit public bodies
We are vendor-independent and recommend the platform that fits your licensing, email system and team:
- Microsoft 365 E5 or Defender for Office 365 Plan 2: Attack Simulation Training is already included; see its licensing
- A UK-based human risk platform: usecure combines training, simulations and policy sign-off with uPolicy
- Training paired with email security: Hornetsecurity Security Awareness Service, Proofpoint Essentials or IRONSCALES
- An expert-run exercise, such as a spear phishing test for senior officers: the consultant-led Bitdefender Phishing Simulation Service
See every option on our vendors hub and in the platforms compared table.
Evidence for audit committees and assurance
Public bodies answer to audit committees, internal audit and, for some, external assurance. Keep evidence that shows the programme is working, not only that it was delivered:
- Training completion by directorate or team, with follow-up for anyone overdue
- Phishing simulation trends: report rate, time to first report and repeat clickers
- Policy acknowledgement records
- Notes from incident exercises, such as those run with the NCSC's free Exercise in a Box
- A short quarterly summary for senior leadership and the audit committee
Our guide to measuring security awareness training includes a board reporting template. Real incidents should still be reported through the official routes: the NCSC's where to report a cyber incident service on GOV.UK points you to the right place.
How we help public sector organisations
We help you write the requirement, choose the platform, connect it to your directory and run the programme: a baseline phishing test, monthly modules, role-based content for high-risk teams, sessions for senior officers and members, and quarterly reports that map to CAF principle B6. Our managed security awareness training service keeps it running without adding work for a stretched IT team.
Contact us to discuss training for your council or public body.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is security awareness training mandatory for councils?
There is no single law that names a specific course for councils. But UK GDPR expects appropriate organisational measures for personal data, the NCSC Cyber Assessment Framework includes a staff awareness and training principle, and insurers and auditors routinely ask for evidence. In practice, regular training with records is expected. This is not legal advice.
What does the Cyber Assessment Framework say about staff training?
CAF v4.0 includes principle B6, 'Staff awareness and training', under objective B, 'Protecting against cyber attack'. Organisations assessed against the CAF need to show how they meet it, and training completion, simulation results and reporting trends are useful evidence when you assess yourself against it.
Can we buy security awareness training through a framework?
Many public bodies do, and others run a quotation under their own procurement thresholds. Tell us which route you need to follow and we will provide the specification details, product information and quotation your process requires.
Do elected members and board members need cyber training?
Yes. They are visible, often use a mix of devices and are attractive targets for impersonation and spear phishing. Short, focused sessions on governance, impersonation and verification usually work better than long modules.
Is there free cyber training for public sector staff?
Yes. The NCSC's Top Tips for Staff e-learning can be completed online or added to your own training platform, and Exercise in a Box is a free NCSC resource, used by local government among others, for practising your response to a cyber attack. A paid platform adds regular simulations, automatic enrolment and records. See our page on free security awareness training.