Free training offered to school staff to help improve cyber defences

New cyber security training resource for the schools sector to improve cyber resilience.

The National Cyber Security Centre (NCSC) have recently released resources, aimed at school staff, to boost their cyber resilience.

The training will set out four steps for school staff to follow to help mitigate cyber incidents, including ransomware attacks. The resources will also include case studies, highlighting the impact of a cyber attack. Including the reality of schools losing substantial sums of money and access to critical systems for weeks

The aim of the training is to help schools improve their defence against online attacks through their new training created directly for teachers and staff by the UK’s leading cyber experts.

The resource is the latest package of support the NCSC has offered the schools sector to improve cyber resilience, and follows an updated alert issued last month to help education establishments in the wake of a rise in ransomware attacks.

The training (available to download at the bottom of the article) shines a light on the main threats schools face and outlines the severe impact cyber incidents can have, with one case study showing how a school lost a substantial sum in school fees after reception staff fell victim to a phishing scam.

Sarah Lyons, NCSC Deputy Director for Economy and Society Engagement, said:

“It’s absolutely vital for schools and their staff to understand their cyber risks and how to better protect themselves online.
“That’s why we’ve created an accessible, free training package offering practical steps on cyber security to help busy professionals boost their defences.
“By familiarising themselves with this resource, staff can help reduce the chances of children’s vital education being disrupted by cyber criminals.”

Schools Minister Nick Gibb said:

“It is vital that schools have robust cyber security in place, and these new resources and training will help staff to increase protection from attacks.
“This training will boost support for schools, giving teachers the tools and skills they need to identify possible risks. I would strongly encourage all schools to adopt the resources and all staff to complete the training to make sure data is protected.”

The training package is designed to be accessible by any staff member, regardless of role or technical knowledge, and is available as a scripted presentation.

The four steps for school staff are being encouraged to follow are:

  1. Defend against phishing attempts: Reduce the information available about you, check for anything that looks suspicious, don’t be embarrassed to ask for help.

  2. Use strong passwords: Choose three random words for your passwords, have a separate password for your work account, switch on two-factor authentication where possible, keep passwords secure by saving them to your browser.

  3. Secure your devices: Don’t ignore updates, only download software and apps from official app stores, put a screen lock on devices (password, PIN, etc), if necessary only use school-issued USB sticks.

  4. If in doubt, call it out: Report anything suspicious as soon as possible and do not be afraid to flag up IT security policies that make your job difficult.

Once the training has been completed staff members can download a certificate which indicates they have taken part.

The case studies based on real cyber incidents include:

  • Administration staff at a school falling victim to a phishing email scam asking for contact details of pupils’ parents. Cyber criminals tricked parents into redirecting school fees, leading to a substantial sum being stolen and parents’ details being sold on the dark web.

  • An unencrypted school USB, which contained details about thousands of pupils, being taken outside of the school and subsequently lost. It was only returned when a member of the public found it by chance.

  • A teacher writing their password on a post-it note stuck to their laptop, which allowed a pupil to gain access to their computer. As the same password was used for multiple accounts, the pupil could access more than 20,000 records and change their grades. The school was disciplined by the Information Commissioner’s Office.

Download • 94.95MB

Additional tailored guidance and advice can be found in a dedicated area on the NCSC website. Resources include questions for schools’ governing bodies to ask school leaders to help improve understanding of cyber risks, as well as cyber security practical tip cards for schools.


The East Midlands Cyber Resilience Centre is non-for-profit and is Policing-led. We provide a range of affordable cyber resilience services with the very current knowledge and technical expertise from the UK's top university cyber talent. Our services help SMEs and therefore supply chain prepare and improve cyber resilience.

Sign up for FREE membership here.



Report all Fraud and Cyber Crime to Action Fraud by calling 0300 123 2040 or online. Forward suspicious emails to Report SMS scams by forwarding the original message to 7726 (spells SPAM on the keypad).


The contents of blog posts on this website are provided for general information only and are not intended to replace specific professional advice relevant to your situation. The intention of East Midlands Cyber Resilience Centre (EMCRC) is to encourage cyber resilience by raising issues and disseminating information on the experiences and initiatives of others. Articles on the website cannot by their nature be comprehensive and may not reflect most recent legislation, practice, or application to your circumstances. EMCRC provides affordable services and Trusted Partners if you need specific support. For specific questions please contact us by email.


EMCRC does not accept any responsibility for any loss which may arise from reliance on information or materials published on this blog. EMCRC is not responsible for the content of external internet sites that link to this site or which are linked from it.