Cyber Security Training for Small Businesses: Where to Start
The best place for a UK small business to start with cyber security training is the free help the National Cyber Security Centre (NCSC) already publishes, followed by Cyber Essentials certification. Work through the NCSC's free Cyber Action Toolkit, give every member of staff the free 'Top Tips for Staff' e-learning (under 30 minutes), then put the five Cyber Essentials controls in place and certify.
Cost need not be the blocker. At the time of writing (November 2026), under a government fund announced on 3 November 2026, eligible micro, small and medium businesses that have not been certified in the last four years can get 75% off Cyber Essentials, paying between £80 and £125 plus VAT, until March 2027 or until the funding runs out.
What small firms are actually up against
The government’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, is the best official picture of what happens to UK firms. For owners of smaller businesses, the headline numbers are these:
- 42% of micro businesses (1 to 9 employees) and 46% of small businesses (10 to 49 employees) reported a cyber security breach or attack in the previous 12 months.
- Phishing remained the most prevalent type of breach or attack by far, experienced by 38% of businesses overall. The survey defines phishing as staff receiving fraudulent emails or being directed to fraudulent websites.
- 17% of micro businesses and 24% of small businesses experienced cyber crime.
- Almost a third of micro businesses (30%) rated cyber security a low priority, and only 21% of micro businesses had a formal incident response plan.
The survey only counts breaches that organisations noticed and were willing to report, so the real figures may be higher. The practical message is that a small firm’s main risk is not a film-style hack. It is a convincing email, a reused password, an unpatched laptop or a missing backup. That is good news, because those are exactly the things a non-specialist owner can fix.
If some of the vocabulary is new, our Key Cybersecurity Concepts and Terms for Beginners explains phishing, malware, multi-factor authentication and Cyber Essentials in plain English.
Free help from the NCSC: use it before you spend anything
The NCSC, part of GCHQ, publishes a set of free tools for small businesses. Its advice page for small and medium organisations sets out a three-step journey: start with the Cyber Action Toolkit, strengthen your resilience with free NCSC tools, then achieve Cyber Essentials.
- Cyber Action Toolkit. Launched on 14 October 2025 as “a single destination for sole traders, micro businesses and small organisations”. It gives free, personalised actions tailored to your business size, and you move through Foundation, Improver and Enhanced levels at your own pace. The NCSC positions it as the way to build confidence to work towards Cyber Essentials.
- Small organisations guide to cyber security. The NCSC guide formerly known as the Small Business Guide, written for organisations with 0 to 49 employees. It covers securing your email and important online accounts, protecting your devices, backing up your data and spotting attacks, and the NCSC says many of the recommendations can be completed in as little as 5 minutes.
- Check your cyber security. Runs remote checks on your public-facing IT systems, email security and web browser. No registration, no downloads, no cost.
- Early Warning. Free email alerts about potential attacks on your network. You need a MyNCSC account, your public IP addresses and domain names, and a contact to receive alerts; the NCSC says sign-up takes about 5 minutes.
- Exercise in a Box. A free way to rehearse your response to an incident, with 20 exercises across 12 topics including ransomware, phishing and passwords.
- Report phishing. Staff can forward suspicious emails to [email protected]; the NCSC can investigate and take down scam addresses and websites.
Cyber Essentials and Cyber Essentials Plus explained
Cyber Essentials is the government-backed certification scheme that the NCSC describes as the minimum standard of cyber security recommended for organisations of all sizes. It is built on five technical controls:
| Control | What it means in practice |
|---|---|
| Firewalls | A security filter between the internet and your network |
| Secure configuration | Computers and devices set up to minimise the ways an attacker can get in |
| Security update management | Software kept up to date so known vulnerabilities cannot be used as a way in |
| User access control | Controlling who can access your data and services, and with what level of access |
| Malware protection | Identifying and stopping viruses and other malicious software before they cause harm |
How certification works
Cyber Essentials is a verified self-assessment. You register through IASME, the NCSC’s Cyber Essentials Delivery Partner, pay, and answer an online question set. Your answers are signed off by a board member or equivalent and then marked by an assessor. You can do this yourself (the self-led route) or pay a licensed Certification Body to help (the supported route). Two free aids help with preparation: the Cyber Essentials Readiness Tool, which produces a tailored action plan, and a free 30-minute session with an NCSC-assured Cyber Advisor for small and medium-sized enterprises.
Cyber Essentials Plus covers the same five controls but adds independent technical testing to check that they work in practice. It gives higher assurance and is priced according to the size and complexity of your network, so you will need a quote.
What it costs, and the funding available now
- Standard fee: priced by organisation size, starting at £320 plus VAT.
- Cyber Essentials First Step Fund (time-limited): at the time of writing (November 2026), this fund, announced on 3 November 2026, gives eligible micro, small and medium UK businesses that have not been certified in the last four years a 75% discount, so they “could pay as little as £80 and no more than £125 (plus VAT)”. It is backed by £2.4m of government funding, is first come, first served, and runs until March 2027 or until the money runs out. Applications go through IASME’s First Step portal.
- Cyber Essentials for Suppliers Grant: a 100% discount plus access to a Cyber Advisor for selected suppliers in the supply chains of organisations that have signed the government’s Cyber Resilience Pledge.
- Included insurance: UK organisations with turnover under £20m that certify their whole organisation are entitled to cyber liability insurance arranged by IASME, worth up to £25,000.
When customers will ask for it
The NCSC notes that a growing number of organisations require suppliers to be certified to bid for work. In central government, Procurement Policy Note 014 (in effect from 24 February 2025) applies Cyber Essentials to contracts where suppliers handle personal data of citizens or of government staff or supply ICT systems that process OFFICIAL data, across departments, their agencies, non-departmental public bodies and NHS bodies. Certificates must be renewed every 12 months to stay valid. Take-up is rising: the share of small businesses holding Cyber Essentials went from 5% to 12% between the 2024/2025 and 2025/2026 surveys.
Training your staff on a small budget
Training matters because the most common attack lands in an employee’s inbox, yet only 19% of businesses ran staff training or awareness activities in the last survey, and 22% tested staff with exercises such as mock phishing. Closing that gap does not need a large budget.
- Start with the NCSC’s Top Tips for Staff. It is free, takes less than 30 minutes, needs no login and covers four areas: strong passwords, securing devices, defending against phishing and reporting incidents. It is aimed mainly at SMEs, charities and the voluntary sector, and can be completed online or loaded into your own training platform.
- Tie training to your own rules. Tell staff who to report to internally, how to forward suspicious emails to [email protected], and how your business verifies any request to change bank details or make an urgent payment.
- Rehearse once a year. A short Exercise in a Box session with whoever would handle an incident (owner, office manager, IT support) shows where your plan is thin.
- Repeat little and often. A five-minute item at a team meeting about a real scam email someone received does more than a long annual session.
Once the basics are in place, role-based training for the people who run your IT, handle finance or sit on the board is the next step. That is where paid, tailored training earns its cost.
A simple 30/60/90-day plan for owners
This plan assumes no in-house security specialist. Name one person as the owner of the plan, but remember the NCSC’s point that cyber security is everyone’s business.
| Period | Goal | Actions |
|---|---|---|
| Days 1 to 30 | Quick wins and visibility | Register for the Cyber Action Toolkit and complete the Foundation level. Turn on two-step verification for email, banking and key cloud accounts. Run Check your cyber security. Sign up for Early Warning. Ask every member of staff to complete Top Tips for Staff. Confirm that backups exist and that you can restore from them. |
| Days 31 to 60 | Close the gaps against Cyber Essentials | Use the Readiness Tool and preview the question set. List every laptop, phone, server and cloud service you use. Remove software that no longer receives updates, take away admin rights people do not need, and check firewall and anti-malware settings. Book the free 30-minute Cyber Advisor session if you are stuck. Write a one-page incident plan: who to call, who decides, where the backups are. |
| Days 61 to 90 | Certify and rehearse | Check eligibility for the First Step Fund and apply before March 2027 if you qualify. Submit your Cyber Essentials assessment. Run one Exercise in a Box scenario. Put the 12-month renewal date in the diary and decide whether customers or contracts mean you also need Cyber Essentials Plus. |
For example, imagine a 12-person accountancy practice in north London. In the first month it might discover that two partners share one email login and that backups have never been test-restored. Fixing those two things will do more for the practice than any tool it could buy.
Where LSCS can help
The free NCSC resources and Cyber Essentials will cover most small firms’ first year. When you need more, the London School of Cybersecurity designs tailored enterprise training that is governance-led and role-based, from board oversight to upskilling the people who manage your systems. If you are not sure what your business needs, book a consultation and we will talk it through.
Frequently asked questions
Is there free cyber security training for small businesses in the UK?
Yes. The NCSC’s Top Tips for Staff e-learning is free, takes less than 30 minutes and needs no login. It covers passwords, securing devices, phishing and reporting incidents.
How much does Cyber Essentials cost for a small business?
The standard fee is priced by organisation size, starting at £320 plus VAT. At the time of writing (November 2026), under the time-limited Cyber Essentials First Step Fund, eligible micro, small and medium businesses not certified in the last four years can pay between £80 and £125 plus VAT, until March 2027 or until the funding runs out.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both cover the same five technical controls. Cyber Essentials is a verified self-assessment, while Cyber Essentials Plus adds independent technical testing of your systems and is quoted according to the size and complexity of your network.
Do I need Cyber Essentials to win government contracts?
Often, yes. Procurement Policy Note 014 applies Cyber Essentials to central government, agency, non-departmental public body and NHS contracts where suppliers handle personal data or supply ICT that processes OFFICIAL data, and certificates must be renewed every 12 months.
Where should a London small business start with cyber security?
The same place as any UK firm: the NCSC’s free Cyber Action Toolkit, then the five Cyber Essentials controls and certification. The NCSC tools are national, so location makes no difference to what you can use.
References
- Department for Digital, Culture, Media and Sport and Department for Science, Innovation and Technology (2026). Cyber security breaches survey 2025/2026. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- National Cyber Security Centre (2025). Small businesses to receive cyber security boost with new toolkit from experts. https://www.ncsc.gov.uk/news/small-businesses-receive-cyber-security-boost-with-new-toolkit-from-experts
- National Cyber Security Centre (n.d., accessed 2026). Cyber security advice for small to medium sized organisations. https://www.ncsc.gov.uk/section/advice-guidance/small-medium-sized-organisations
- National Cyber Security Centre (n.d., accessed 2026). Small organisations guide to cyber security. https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security
- National Cyber Security Centre (n.d., accessed 2026). Check your cyber security. https://www.ncsc.gov.uk/section/active-cyber-defence/check-your-cyber-security
- National Cyber Security Centre (n.d., accessed 2026). Early Warning. https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning
- National Cyber Security Centre (n.d., accessed 2026). Exercise in a Box. https://www.ncsc.gov.uk/section/exercise-in-a-box/overview
- National Cyber Security Centre (n.d., accessed 2026). Report an email you think is a scam. https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email
- National Cyber Security Centre (n.d., accessed 2026). Top Tips for Staff. https://www.ncsc.gov.uk/information/top-tips-for-staff
- National Cyber Security Centre (n.d., accessed 2026). Cyber Essentials overview. https://www.ncsc.gov.uk/cyberessentials/overview
- Department for Digital, Culture, Media and Sport (2026). New government-backed cyber security protections could save UK businesses thousands. https://www.gov.uk/government/news/new-government-backed-cyber-security-protections-could-save-uk-businesses-thousands
- Department for Digital, Culture, Media and Sport (2026). Cyber Essentials funding package. https://www.gov.uk/government/publications/cyber-essentials-funding-package
- Cabinet Office (2025). PPN 014: Cyber Essentials scheme. https://www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme/ppn-014-cyber-essentials-scheme-html
Stay Ahead With LSCS
Get critical Cybersecurity updates, events invitations, and industry analysis. Our immersive, hands-on training is the most direct path to a high-growth cyber career.