Cyber security awareness training online in the UK: where to train and what employers look for

What employers look for in an online cyber security awareness certificate

Your employer decides what cyber security training you need. UK GDPR Article 32 and the Data Protection Act 2018 expect anyone who handles personal data to have appropriate technical and organisational measures in place, and the Information Commissioner treats staff awareness training as one of those measures. The NCSC's 10 Steps to Cyber Security includes engagement and training, and Cyber Essentials sets basic controls that depend on how staff behave. When an employer checks a certificate, they usually look for:

• Content that follows UK law and NCSC guidance. UK GDPR and the Data Protection Act 2018, the Information Commissioner's security guidance, the Computer Misuse Act 1990, Cyber Essentials and the NCSC 10 Steps to Cyber Security.
• A clear, verifiable record. The course name, hours of learning and completion date, with a way to confirm the certificate.
• The essentials every member of staff needs. Phishing and other social engineering, passwords and multi-factor authentication, device security and home working, malware and ransomware, handling personal data safely, and reporting an incident fast.
• A refresh date. Attackers change their methods constantly, and most organisations, insurers and Cyber Essentials assessors expect staff to be trained at induction and at least once a year, so a refresh date matters.

Lift College's certificate does each of these. It records Cyber Security Awareness Training, 2 hours of learning, your completion date and a recommended refresh date 12 months on, with a unique certificate number and a verification link. The course gives every member of staff the knowledge; your IT team or provider still sets up the technical controls, and your employer will show you its own acceptable use rules and incident reporting route.

What the Lift College course covers

There are 6 short modules, each with a knowledge check, then a final test with an 80% pass mark and unlimited free retakes.

1. Cyber security and the threat to you. What cyber security means, who attacks organisations and why: criminals after money and data, insiders, and automated attacks that hit any organisation of any size. What a breach costs in work, money, reputation and regulatory action.
2. Phishing and social engineering. Phishing emails, smishing texts, vishing calls, QR code scams and spoofed senders. The pressure tactics of urgency, authority and fear, business email compromise and invoice fraud, and the checks to make before you click, pay or reply.
3. Passwords, authentication and devices. Three random words, password managers, never reusing passwords, and multi-factor authentication. Locking screens, installing updates, antivirus, public Wi-Fi, USB devices, personal phones and keeping work safe when you work from home.
4. Malware and ransomware. Viruses, spyware, trojans and ransomware, how they arrive through attachments, downloads, links and removable media, the signs of an infection, why backups matter and what to do, and not do, when a device is compromised.
5. Protecting personal data and the law. UK GDPR Article 32 and the Data Protection Act 2018, what counts as a personal data breach, the 72 hour report to the Information Commissioner, the Computer Misuse Act 1990, acceptable use, sending and storing data securely, clear screens and desks, and disposing of data and devices.
6. Spotting, reporting and recovering from an incident. What an incident looks like, who to tell and why minutes matter, your organisation's incident plan, reporting suspicious emails to the NCSC and texts to 7726, Action Fraud and Police Scotland, and how Cyber Essentials and the 10 Steps to Cyber Security fit together.

By the end you can recognise phishing, smishing, vishing and impersonation and check a message before acting on it, apply the NCSC's advice on passwords, multi-factor authentication and updates, describe how malware and ransomware get into an organisation, explain your duties under UK GDPR Article 32 and the Data Protection Act 2018, and take the right steps when you spot a suspicious message, lose a device or think something has gone wrong.

The law and guidance it is written around

• UK GDPR Article 32 and the Data Protection Act 2018 (UK wide). Anyone who processes personal data must put appropriate technical and organisational measures in place to keep it secure, including protection against unauthorised access, loss and destruction. Staff awareness training is one of the organisational measures the Information Commissioner expects to see.
• ICO guidance on security under the UK GDPR (UK wide). The Information Commissioner's guidance on what appropriate security means in practice, across people, processes and technology. It expects staff to understand their responsibilities, and organisations to report a personal data breach that risks people's rights within 72 hours of becoming aware of it.
• Computer Misuse Act 1990 (UK wide). Makes it a criminal offence to access a computer or data without authorisation, to do so in order to commit another offence, or to impair the operation of a computer, for example by spreading malware. Using a colleague's login or looking at records you have no business reason to see can fall under this Act.
• NCSC Cyber Essentials (UK, government-backed scheme). Sets five basic technical controls: firewalls, secure configuration, security update management, user access control and malware protection. It is not law, but many public sector and larger contracts require suppliers to hold it, and the course explains the user behaviours that support each control.
• NCSC 10 Steps to Cyber Security (UK, guidance). The National Cyber Security Centre's guidance for organisations on managing cyber risk. The steps include engagement and training, identity and access management, data security and incident management.

How Lift College compares with other UK providers

Details below are as each provider shows them on its own course page, checked 27 October 2026. "Check provider" means the page did not state it.

With Lift College the £19.99 is the full price for one learner, with nothing added at checkout, and the refresher is free when your recommended refresh date arrives. Retakes of the final test are free and unlimited.

Who it suits

Cyber Security Awareness Training is for every member of staff who uses a computer, phone or email at work in England, Wales, Scotland and Northern Ireland. It is for you if:

• you use email, the internet or a shared system as part of your job
• you work from home or on the move with a laptop or phone
• you handle customer, patient, pupil or employee records
• you approve payments, change supplier details or manage accounts
• you manage a team or run a small organisation and need everyone to share the same baseline

If you also handle personal data in your role, see our GDPR training guide and our data protection training guide. See every course on the workplace compliance courses page or browse all Lift College CPD courses. Buying for a team? Open a free organisation account: every course is £16.99, and you can pay by card or invoice with your PO.

Enrol on Cyber Security Awareness Training for £19.99 and start module 1 the minute you pay. Ask within 14 days of paying and we refund you in full.