Cyber Security and Online Safety for UK Employees
WORKPLACE LEARNING / PUT SECURITY INTO PRACTICE
Spot the pressure. Check the request. Report early.
Practical, text-based cyber awareness for employees in UK organisations. You do not need to be an IT expert. You do need a reliable way to check unusual requests and get help.
What you will be able to do
- Check unexpected payment, login and data requests using a contact route you already trust.
- Use your organisation’s password manager, multi-factor authentication and approved devices safely.
- Handle personal and business information on a need-to-know basis, including when using cloud and AI tools.
- Respond to a suspicious login, misdirected email or lost device without trying to investigate alone.
- Find the right internal contact and give a short, useful incident report.
Your route through the course
The course has 10 text lessons and three knowledge-check quizzes. The numbered parts cover threats and authentication, information handling and policy, then remote working and incident response. The quizzes are listed after the lessons. Read, make a decision in the scenarios, then use the quizzes to check what you would do.
Before lesson one: build your two-minute contact card
Keep this privately in your approved work system, not in course answers:
- IT/security contact and an alternative phone route if work email is unavailable.
- Your manager or duty contact, including the agreed out-of-hours route.
- The data-protection lead and the policy for reporting a wrong-recipient email or lost device.
- The approved procedure for checking supplier bank-detail changes.
If you cannot fill a line in, ask your manager. Finding the route now is part of the training.
For managers: turn learning into a team habit
- Tell staff where to report and what to do if that route is unavailable. Do not invent a process during an incident.
- Use a fictional supplier bank-change request in a team discussion. Ask who would verify it, by which known number, and who can approve it.
- At the end, ask each learner for one action they have changed. Do not ask them to paste passwords, customer records or real incident evidence into the course.
- Review any uncertainty with your IT/security and data-protection leads. Training complements technical controls, backups and clear procedures; it does not replace them.
Access and scope
This is awareness training, not legal advice, a professional qualification, Cyber Essentials certification or a guarantee that attacks will be prevented. It does not replace your employer’s policies. Whole-team seat purchasing, delegated administration and organisation-wide reporting are not included in the current self-service learner area; contact support to discuss an enquiry before offering staff access.
NCSC: top tips for staff | NCSC: phishing guidance | My learning
