How do I train my staff on cybersecurity?
Train little and often: a 15-minute session when someone joins, then a short monthly reminder built on a real example. Cover phishing, the payment-change rule, passwords and passkeys, updates and how to report a mistake. Use free materials from CISA, NIST and the FTC, and thank people who report, even when they clicked.
The short version
- On day one: 15 minutes on the rules in your security plan.
- Every month: a five-minute reminder using a real example, ideally one your team received.
- Cover five things: phishing, the payment-change rule, passwords and passkeys, updates, and how to report.
- Make reporting easy: one named person, one simple way, and thanks every time.
- Use free materials from CISA, NIST and the FTC.
What should training cover?
CISA’s Secure Our World campaign boils it down to four habits: avoid and report phishing scams, use strong passwords, use multifactor authentication and a password manager, and update software. For a small business, add one more: the payment-change rule.
| Topic | The one thing staff must remember |
|---|---|
| Phishing | Don’t use links or numbers in an unexpected message. Go to the site or call a known number yourself |
| Payment changes | Any new or changed bank detail is confirmed by phone, on a number we already have |
| Passwords and passkeys | Everything goes in the password manager. Turn on passkeys when asked |
| Updates | Restart when the computer asks. Don’t postpone for weeks |
| Reporting | Tell the named person straight away, even if you’re not sure |
For the payment rule in detail, see business email compromise. For phishing signs, see how to spot a phishing email.
How often, and how long?
Short and regular beats long and yearly. A suggested rhythm:
- New starter: 15 minutes in their first week, plus their password manager and passkey setup. See rolling out a password manager.
- Monthly: five minutes at a team meeting. Show one real suspicious email and talk through the signs.
- Twice a year: a short practice run. “The bookkeeper’s email has been hacked. What do we do?” Walk through the first hour after an account takeover.
- When something changes: a new tool, a new scam doing the rounds, or a near miss.
Where do I find free materials?
- CISA has awareness training resources and the Secure Our World tip sheets and videos.
- NIST’s Small Business Cybersecurity Corner has a training page and short videos.
- The FTC’s Cybersecurity for Small Business page covers phishing, ransomware, business email imposters and tech support scams in plain language. Its consumer phishing guide is a good handout.
Some businesses add simulated phishing emails. They can help, if they’re used to teach rather than to catch people out.
How do I make it safe to report mistakes?
The worst outcome is a staff member who clicked a bad link and stays quiet because they’re embarrassed. Minutes matter in an account takeover or payment fraud.
- Name one person to tell, and a backup.
- Accept reports by phone, in person or by forwarding the email.
- Say thank you every time, including false alarms.
- Never punish a fast, honest report.
What should staff report?
- An email or text asking them to sign in, pay, or change details.
- A sign-in prompt or code they didn’t request. Never approve it.
- A call from “IT support” or “Microsoft” they weren’t expecting.
- A lost phone or laptop.
- Anything they clicked and then wondered about.
What are the common mistakes?
- Once-a-year slideshows nobody remembers.
- Generic examples that look nothing like your real email.
- Blaming people, so the next person hides their mistake.
- Forgetting the owner and managers. Criminals often target the people who can approve payments.
- Not training on leaving. Remind leavers that business accounts stay with the business, and remove their access on their last day.
What if someone already clicked?
Thank them, then act. If they entered a password, follow the first-hour steps. If they downloaded something, disconnect that computer from the network and call your IT support. If money moved, call the bank first.
How much does it cost, and how long does it take?
The government materials are free. Plan about 15 minutes per new starter and five minutes a month for the team.
How does E-3 handle this?
On the sites E-3 looks after, people at E-3 make the changes, and updates are tested on a staging copy first, which is one less thing for staff to watch for. For phishing and account security, use the free materials above and your security plan.
Related questions
Next step
- Next: What should I ask a vendor before giving them access?The next guide in Cybersecurity basics.
- Website careUptime monitoring, tested updates, daily backups and security alerts.
Still stuck? Ask E-3 for an answer from our help guides.
Rather we handled cybersecurity basics for you?
It’s part of what we do every week for small businesses, as part of website care. Start with a free check of your site and profile, or call and ask.