Cyber Security
Your Staff Completed Cyber Security Training. Can You Prove It Changed Anything?
Training records show that a course was completed. They do not, by themselves, prove that people know how to protect information or report a problem.
7 min read — Altitude IT Support
A completed course is useful evidence that someone received information at a particular time. It cannot show, on its own, whether the employee can apply that guidance when handling a sensitive attachment, approving an unexpected sign-in request or reporting a suspicious message. The practical test is whether training, procedures and technical safeguards work together when someone is busy or uncertain.
What the Metropolitan Police case shows
The Information Commissioner's Office (ICO) issued the Metropolitan Police Service with an enforcement notice and reprimand in August 2026 after two disclosures involving sensitive information. One involved unredacted documents containing a victim's new contact details; another exposed the email addresses of people connected with a sensitive investigation. The ICO said the failures reflected weaknesses in training compliance, monitoring, governance and the processes used to prepare and check information.
Separate reporting later raised questions about the force's training completion figures. A percentage from a meeting is a snapshot, not a current count for every person. The official enforcement action is more important for businesses than any single percentage: training matters, but it was not the only control needed. A second-person check, safer document handling and suitable communication methods could help catch mistakes before information leaves the organisation.
Separate scheme requirements from wider good practice
Cyber Essentials is a certification scheme focused on five technical control areas: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus starts with the verified self-assessment and adds a technical audit of in-scope systems to check that the controls are in place. Neither should be described as requiring every organisation to complete an annual staff-awareness course.
Staff awareness is still a sensible part of a wider security programme. Businesses may have legal, contractual or sector-specific duties that call for training, but that is different from claiming it is a universal Cyber Essentials certification requirement. Keep the distinction clear when talking to customers, insurers and assessors. If you are working towards certification, use the current scheme requirements for the right version rather than relying on an old checklist.
Make the training relevant to the work
Start with the situations employees actually face. A person who pays suppliers needs a clear process for checking bank-detail changes. Someone who handles client records needs to know how to send information safely and report an accidental disclosure. An administrator needs stronger guidance on privileged accounts and unexpected authentication prompts. A new starter should know where to ask for help before a mistake becomes an incident.
Keep the route for reporting simple and visible. Staff should know who to contact, what information to provide and whether they should disconnect a device or stop a process while waiting for advice. Do not treat a reported mistake as proof that training failed; prompt reporting can reduce harm. Review incidents and near misses for unclear instructions, unsuitable tools, workload or access that made the error easier.
Evidence to request from your IT provider
Ask for evidence that shows the whole control, not just the course platform:
- Training completion by role or team, overdue items and named follow-up responsibility.
- How joiners, leavers and role changes affect training and system access.
- The current process for reporting suspicious messages, lost devices and accidental disclosure.
- Access-control records, privileged-account review dates and the technical measures that limit harm.
- Examples of how lessons from incidents or exercises led to a change in a procedure or setting.
Where phishing exercises or other tests are used, ask what the results measure and how staff are supported. A click rate alone is not a complete measure of readiness. The more useful questions are whether people recognise the reporting route, whether reports reach the right person and how quickly the business can contain a suspected compromise.
A short check for managers
- List the decisions and information-handling tasks where a mistake could matter.
- Give the relevant roles concise guidance and a clear route to ask for help.
- Check that permissions, approval steps and sending tools support the intended behaviour.
- Run a realistic scenario and observe whether people know what to do next.
- Review completion and incident evidence, assign improvements and check them again.
Training is one part of a control system. A certificate without access management, safe processes and follow-up may satisfy a record-keeping need while leaving the underlying risk unchanged. If an employee clicked a malicious link tomorrow, would they know exactly what to do?