Cyber Security Training for Boards: What It Covers and What It Costs

This guide explains why the training matters now, what a good programme should cover, the main formats, and what pushes the price up or down.

Why boards need cyber training now

The clearest signal comes from government. On 8 April 2025 the government published the Cyber Governance Code of Practice, which gov.uk lists as published by the Department for Science, Innovation and Technology (DSIT), the National Cyber Security Centre (NCSC) and the Department for Digital, Culture, Media and Sport (DCMS). It is a voluntary code, designed for the boards and directors of medium and large organisations, public and private. It sets out five principles: risk management, strategy, people, incident planning, response and recovery, and assurance and oversight.

One of its actions (C3) is aimed squarely at directors themselves: “Undertake training to improve your own cyber literacy and take responsibility for the security of the data and digital assets that you use.” Training is not treated as optional extra reading. It sits inside the governance framework alongside risk ownership and incident planning. (Other articles on this blog cover the Code in detail, along with the questions directors should put to their CISO and the question of personal liability, so we only touch on those here.)

The government’s own research explains why. In its response to the call for views on cyber governance (January 2025), DSIT noted, citing its Cyber Security Breaches Survey 2024, that boards are prevented from engaging more in cyber security by “a lack of knowledge, training and time”. The same document reports clear demand from industry for direction on “what good looks like”, particularly from directors who do not have a technical background in cyber. The Cyber Security Breaches Survey 2025/2026 (published 30 April 2026) found that 31% of UK businesses had board members or trustees taking explicit responsibility for cyber security, rising to 68% of large businesses. Only 16% of businesses and charities had heard of the Code, although awareness among large businesses was 51%.

Government has since gone further. Organisations that sign its voluntary Cyber Resilience Pledge, announced in April 2026 and formally launched in July 2026, commit to implementing all actions in the Code and to ensuring all board members undertake the NCSC’s Cyber Governance Training within 3 months and then on an annual basis.

In short: the expectation is written down, the support exists, and many boards have not yet caught up.

What good board-level cyber training covers

Board training should be built around decisions directors actually take. A useful test is whether each session maps to something the board does: approving a budget, setting appetite, reviewing a report, or leading during a crisis. Good programmes usually cover:

• The threat picture in business terms. Which threats matter for your sector and what they would do to revenue, operations, customers and reputation.
• The board’s role. Oversight, challenge, accountability and assurance, and where the line sits between governing cyber risk and managing it day to day. The Code itself says it is not intended for those responsible for day-to-day cyber security management.
• Risk appetite and risk reporting. How to set tolerance, read a risk register, and spot when a dashboard hides more than it shows.
• Regulation. The obligations relevant to your organisation, for example UK GDPR and the Data Protection Act 2018, the NIS Regulations 2018, or FCA and PRA operational resilience rules for financial firms.
• Supply chain exposure. How to oversee third-party and supplier risk rather than assume it is someone else’s problem.
• Incidents. What the board does before, during and after a breach: decision rights, reporting duties, communications and recovery. The Code asks boards to gain assurance that the incident plan is exercised at least annually.
• Culture and people. How the board’s own behaviour shapes security culture, and how to gain assurance that staff training is effective.
• Talking to the security team. Asking questions that get useful answers, and translating technical findings into business decisions.

Training that spends most of its time on how malware works, or on product demonstrations, is aimed at the wrong audience. Directors need enough technical vocabulary to follow a briefing, then the governance tools to act on it.

Free resources every board should use first

Before paying for anything, it is worth knowing what the NCSC already provides at no cost:

• Cyber Governance Training. An introductory module followed by five interactive modules, each covering one of the Code’s principles and each taking approximately 20 minutes. The NCSC states that the package is completely free to use.
• Cyber Security Toolkit for Boards. Guidance that helps boards put the Code’s actions into practice, with downloads including a “Cyber security 101 for Board Members” sample script of questions and a set of questions (with possible answers) for the board to ask.
• Exercise in a Box. A free online resource that helps organisations test and practise their response to a cyber attack, including table-top group discussion exercises.

These are a strong baseline. What they cannot do on their own is apply the material to your organisation’s specific risks, sector rules and board dynamics, or give directors live practice making decisions under pressure. That is where paid formats come in.

The main training formats

Most board training falls into one of four formats. Many organisations combine two or more.

1. In-house briefing

A short session delivered to the board, often within or alongside a scheduled meeting. Good for raising a baseline quickly or covering a single topic, such as a new regulation or the lessons from a recent incident elsewhere in the sector. Limited depth, and little time for practice.

2. Workshop

A longer, interactive session for the board or a committee (often audit and risk). Workshops work best when they use the organisation’s own risk register, reporting and incident plan as material, so directors leave with agreed actions rather than general awareness.

3. Accredited or certified course

A structured programme with set learning outcomes and an assessment, attended by individual directors, sometimes alongside peers from other organisations. Useful when a director wants recognised evidence of learning, or is preparing for a committee role. In the UK, the NCSC runs the NCSC Assured Training scheme, which assures the quality of course content and delivery and lists several awareness-level courses aimed at boards and senior leaders; other courses carry accreditation from professional bodies.

4. Tabletop exercise

A facilitated, discussion-based simulation of an incident, played out in stages. Directors make decisions as the scenario unfolds: whether to pay a ransom, when to notify regulators, what to tell customers. Tabletops expose gaps in decision rights and communication that no slide deck will. They also support the Code’s expectation that incident plans are exercised at least annually.

What drives the cost of board cyber training

Prices vary widely and there is no single market rate, so the useful question is what you are paying for. These are the factors that move the price.

Two practical points. First, check whether a quote is per delegate or per engagement, and compare like with like: for a whole board, the per-head cost of a private session and of individual places on an open course can differ in either direction. Second, check whether the price includes preparation, such as reviewing your risk register or writing a bespoke scenario, since that is often where the value lies.

How to choose the right mix

For example, imagine a mid-sized firm whose board has never had formal cyber training. A sensible sequence might be:

1. Every director completes the free NCSC modules to build a shared vocabulary.
2. The board holds a tailored workshop using its own risk register and latest security report.
3. The chair of the audit and risk committee, or the director with cyber responsibility, takes an accredited course for deeper knowledge.
4. The board runs a tabletop exercise each year, testing the incident plan with the executive team.

Whatever you choose, record it. Board minutes that show training completed, exercises run and actions followed up are part of demonstrating that the board takes its oversight role seriously.

Board training at LSCS

Our Board Governance of Cybersecurity course is 12 hours of intensive training, run as 1 day in person or 5 days virtual instructor-led, and is BCS Tech 10 accredited. It covers the board’s role in cyber risk (including the NCSC Board Toolkit), regulation, privacy oversight, board-level breach simulations and a Board and CISO role-play. It is listed at £1,900; contact us for dates. Organisations wanting a version for a whole board can explore enterprise training, and anyone wanting a grounding in governance concepts can start with our free GRC course. To discuss your board’s needs, book a consultation.

Frequently asked questions

Do board members legally have to take cyber security training?

The UK Cyber Governance Code of Practice is voluntary, but it asks directors to undertake training to improve their own cyber literacy. Organisations that sign the government’s voluntary Cyber Resilience Pledge commit to all board members taking the NCSC’s Cyber Governance Training within 3 months and then annually. Some sector regulators have their own expectations, so check the rules that apply to your organisation.

Is there free cyber security training for board members in the UK?

Yes. The NCSC offers free Cyber Governance Training: an introductory module followed by five interactive modules, one for each of the Code’s principles, each taking about 20 minutes.

How much does board-level cyber governance training typically cost?

There is no single market rate. Cost depends on format, length, tailoring, accreditation and delivery: free e-learning sits at one end, and private, tailored workshops or tabletop exercises for a whole board at the other.

What is the difference between a board workshop and a tabletop exercise?

A workshop builds knowledge and agrees actions using the organisation’s own material. A tabletop exercise is a facilitated incident simulation where directors make decisions as a scenario unfolds, testing the incident plan.

How often should boards have cyber training?

There is no fixed rule, but the Code asks boards to gain assurance that the incident plan is exercised at least annually, which makes a yearly exercise a natural anchor, with refreshers when risks or regulations change.

References

• Department for Digital, Culture, Media and Sport, National Cyber Security Centre and Department for Science, Innovation and Technology (2025). Cyber Governance Code of Practice. https://www.gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice
• Department for Science, Innovation and Technology (2025). Government response to the call for views on cyber governance. https://www.gov.uk/government/publications/government-response-on-cyber-governance/government-response-to-the-call-for-views-on-cyber-governance
• Department for Science, Innovation and Technology and National Cyber Security Centre (2025). Business leaders supported to bolster online defences to safeguard growth. https://www.gov.uk/government/news/business-leaders-supported-to-bolster-online-defences-to-safeguard-growth
• Department for Digital, Culture, Media and Sport and Department for Science, Innovation and Technology (2026). Cyber security breaches survey 2025/2026. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
• Department for Digital, Culture, Media and Sport and Department for Science, Innovation and Technology (2026). Cyber Resilience Pledge. https://www.gov.uk/government/publications/cyber-resilience-pledge
• National Cyber Security Centre. Cyber Governance Training. https://www.ncsc.gov.uk/cyber-governance-for-boards/training
• National Cyber Security Centre (2023, reviewed 2025). Cyber Security Toolkit for Boards. https://www.ncsc.gov.uk/collection/board-toolkit
• National Cyber Security Centre. Exercise in a Box. https://www.ncsc.gov.uk/section/exercise-in-a-box/overview
• National Cyber Security Centre (2019, reviewed 2025). NCSC Assured Training. https://www.ncsc.gov.uk/information/ncsc-certified-training
• Department for Science, Innovation and Technology (2024, updated 2025). Cyber security codes of practice. https://www.gov.uk/government/collections/cyber-security-codes-of-practice
• London School of Cybersecurity (2026). Board Governance of Cybersecurity course. https://lscs.io/board-governance-of-cybersecurity-course-details/
• UK Parliament (2018). Data Protection Act 2018. https://www.legislation.gov.uk/ukpga/2018/12/contents
• UK Government (2018). The Network and Information Systems Regulations 2018. https://www.legislation.gov.uk/uksi/2018/506/contents
• Financial Conduct Authority (2017, updated 2026). Operational resilience. https://www.fca.org.uk/firms/operational-resilience