Free practical resources
Education cyber awareness staff pack
Put the learning into practice with editable contact cards, response guidance and team activities.
Version 2026.10. Download the plain-text templates, open them in your preferred text editor and adapt them to your approved procedures. No account or learner details are needed. Keep completed internal records in your own approved systems.
Back to the course overviewIncident contact card
Complete this before an incident. Keep an approved offline copy and test the alternative reporting route. Use internal contact details, never passwords or recovery codes.
- School or trust name: ____________________
- Primary IT/incident reporting route: ____________________
- Alternative route if email or the helpdesk is unavailable: ____________________
- Out-of-hours contact and when to use it: ____________________
- Data protection lead/DPO and route: ____________________
- Designated safeguarding lead (DSL) and urgent safeguarding route: ____________________
- Manager/incident coordinator: ____________________
- Approved isolation instructions and offline plan location: ____________________
- Owner: __________ Last checked: __________ Next check: __________
- If there is immediate danger, follow your emergency arrangements. Cyber reporting does not replace urgent safeguarding or emergency action.
Clicked a link or entered a password?
Report quickly, even if you are unsure. An early report helps protect colleagues and information. You do not need to investigate first.
- Stop interacting with the message or page. Do not approve unexpected MFA prompts or enter more information.
- Use the approved incident route from a safe device. If normal systems are unavailable, use your alternative contact card.
- Tell the response team when it happened, the account/device involved and whether you entered a password, approved MFA, downloaded a file or shared information. Never send them your password or one-time code.
- If credentials were entered, change the affected password through the approved service or follow the response team’s instructions. A password reset alone may not end active sessions.
- If a file ran, a device behaves unusually or a ransom demand appears, stop using it and follow your approved isolation instructions. Do not wipe, privately repair, negotiate or pay.
- Preserve the message or relevant details using the approved reporting method. Do not forward sensitive files widely or revisit the suspicious link.
- Where pupil information, safeguarding access or safety may be affected, also follow the school’s data and safeguarding reporting arrangements.
- Record the incident reference and follow-up action. Report mistakes without blame; use the learning to improve controls.
Five behaviours to display and practise
Use as a staff-room or workplace reminder. Add your local reporting route before sharing.
- PAUSE when a request, link or sign-in prompt is unexpected. Urgency and a familiar name are not proof.
- VERIFY through a separate route you already trust. Use independently held contact details for payment changes.
- PROTECT accounts with unique credentials, approved password managers/passkeys and MFA. Never approve an unexpected prompt.
- HANDLE information using approved systems, verified recipients and minimum necessary access.
- REPORT concerns, mistakes and unusual activity early. Use the alternative route if normal systems are down.
- Our reporting route: ____________________
- Our alternative route: ____________________
Manager briefing and team discussion
Allow 15 minutes after staff complete the course. Use fictional examples and avoid naming people involved in real mistakes.
- Beforehand: agree incident contacts, the alternative route and the policy or process staff should follow.
- Ask: a known supplier emails new bank details in a real invoice thread. How do we verify the change independently? Who can approve it?
- Ask: someone entered credentials on an unexpected page. How can they report immediately without fear of blame?
- Ask: email is down and a device shows a ransom demand. Where is our offline contact card? What should staff avoid doing?
- Ask: sensitive pupil information went to the wrong recipient. Which IT, data and safeguarding routes apply, and who coordinates them?
- Keep CompTech completion and official NCSC evidence separate. Follow current school/trust and RPA requirements; this pack is not compliance evidence.
- Agree one improvement, an owner and a due date. Test that staff can find the reporting route.
- Action: __________ Owner: __________ Due: __________
- Return to one scenario at the next team meeting. Check understanding and confidence to report, not just attendance.
New-starter and refresher checklist
For managers and staff to complete together. Adapt to the role, including temporary staff and volunteers. A tick records discussion, not independent verification.
- [ ] I know the approved tools, information-handling rules and who can grant access.
- [ ] I have my own appropriate account and know how to protect it with MFA and approved password tools.
- [ ] I can find the normal and alternative incident routes without relying on email.
- [ ] I know what to do after a suspicious message, unexpected MFA prompt, wrong recipient or lost device.
- [ ] I know how to independently verify a payment or sensitive information request.
- [ ] I have completed the relevant course and discussed the scenarios I found difficult.
- [ ] I know when to involve the DSL and DPO/data lead.
- [ ] The responsible person has checked whether separate official NCSC training/evidence is required and where to keep it.
- [ ] My manager has agreed any role-specific learning and a refresher date.
- Role: __________ Discussed with: __________ Date: __________
- Follow-up action: __________ Review date: __________
School training evidence register template
Keep this in your approved staff records with appropriate access and retention. Do not upload completed records to CompTech. This is a blank administration aid, not a claim of compliance.
- Staff role or approved internal identifier: ____________________
- CompTech course version and local completion date: ____________________
- CompTech completion record retained at: ____________________
- Official NCSC training completion date: ____________________
- Separate official NCSC certificate or required evidence retained at: ____________________
- Evidence checked by authorised school/trust owner: ____________________
- Current school/trust/RPA requirements checked on: ____________________
- Next training due under those requirements: ____________________
- Outstanding evidence or follow-up: ____________________
- The CompTech acknowledgement is self-attested. Its certificate does not verify NCSC completion or prove RPA compliance.