Cyber Essentials and staff training: what assessors and insurers look for

What Cyber Essentials actually covers

Cyber Essentials is the UK government-backed scheme, overseen by the NCSC, that sets out the basic technical protections every organisation should have. It focuses on five controls:

• Firewalls: a barrier between your devices and the internet, letting through only the connections you need.
• Secure configuration: removing default passwords, unused software and accounts nobody needs.
• User access control: giving people only the access their job requires, and protecting accounts properly, including multi-factor authentication.
• Malware protection: stopping malicious software from running, for example with anti-malware software or by only allowing approved apps.
• Security update management: keeping devices and software supported and promptly updated.

Here's the part that often gets muddled: Cyber Essentials does not itself require security awareness training. You can certify without running a single training session or practice email. If anyone tells you a particular training product is needed to pass, they're mistaken.

Cyber Essentials Plus covers the same five controls, with an assessor testing your systems hands-on rather than relying only on your answers to the questionnaire.

Where people still show up

Even without a training requirement, several of the controls rely on people doing the right thing day to day: using admin accounts only for admin tasks, choosing strong passwords and not reusing them, turning on multi-factor authentication, and installing updates rather than postponing them. Assessors check the controls, not the training. But a team that understands why the controls exist is far more likely to keep them in place between one certificate and the next.

Why training still matters

If Cyber Essentials doesn't ask for it, why bother? Because the five controls protect your devices and accounts, and some attacks walk straight past them. A fully updated laptop behind a good firewall will still let someone type their password into a convincing fake login page, or pay an invoice into the wrong account. Those attacks target people's decisions, and practice is what changes those.

There are practical reasons too.

Insurers often ask

Many cyber insurance proposal forms ask whether staff receive security awareness training, how often, and sometimes whether it includes phishing exercises. The questions vary between insurers and change over time, so read your own form carefully. Answering “yes” honestly is much easier when you have a simple record behind it.

Other frameworks and customers expect it

Standards such as ISO/IEC 27001 include awareness and training. Larger customers often send supplier security questionnaires that ask about it too. If you handle personal data, UK GDPR expects appropriate technical and organisational measures to keep it secure, and staff awareness is a natural part of the organisational side.

It supports the bigger picture

Training and technical controls reinforce each other. People who understand why updates matter install them. People who know what a lookalike domain looks like report one. When an assessor, auditor or insurer asks about how seriously you take security, ongoing awareness is part of the answer.

What good evidence looks like

When someone asks “do you train your staff?”, they're usually looking for four things. You don't need a binder. A single page or a shared folder will do.

1. What you did. For example: a practice phishing email every month, a 60-second lesson for anyone who clicked, and short training modules for new starters.
2. When. Dates for each campaign or session, showing it's ongoing rather than a one-off.
3. Who took part. Ideally everyone with an email account, including directors and part-timers.
4. What changed. Trends over time, such as fewer clicks on similar lures, more people reporting suspicious emails, or lessons completed.

Keep it honest. “We started in March and send a practice email every month” is stronger than a polished policy nobody follows. And keep individual results private. An insurer or assessor wants to see a programme, not a list of names.

A simple record

One line per campaign is plenty. For example: date · lure used · people included · clicked · lessons completed · reported. Twelve lines a year tells a clear, believable story.

Answering the insurer's question

When a proposal form asks about training, a short, specific answer works best. Something like: “Yes. Every member of staff receives a practice phishing email each month at a random time, with a short lesson for anyone who clicks. New starters complete introductory security training in their first week. We keep a dated record of each campaign.” Only write what's true, and update it if your programme changes.

Keeping the paperwork light

Most small businesses don't struggle with doing the training. They struggle with remembering to record it. A few habits help:

• Write a one-paragraph policy. What you do, how often, and that results are never used for discipline. That's your policy.
• Record as you go. Note the date and headline results after each campaign, rather than piecing together a year before renewal.
• Keep one folder. Your policy, your campaign records and copies of past questionnaire answers, all in one place.
• Check once a year. Before renewal, make sure your records match what you're about to tell your insurer.

Lureproof handles the doing part for small teams on Google Workspace or Zoho, with Microsoft 365 coming soon. It sends practice emails at random times, turns clicks into 60-second lessons, and its dashboard shows who received, opened and clicked each campaign, which you can share with your insurer or assessor. A downloadable compliance PDF report is coming soon. It's free for up to five people, and our free security training is open to everyone.

FAQ