Cybersecurity for schools and early years settings

Who it is for

Objectives

Sessions and topics

6 sessions × 90 minutes · 9 hours · The final assessment takes place separately from the live sessions.

1. Session 1

   • Why people are targeted — See why attackers target the people who handle money, information and decisions. Learn when to pause and check a request before it causes a loss.
   • Cyber threats and business impact — Understand cyber threats through their business impact: lost money, stolen information and interrupted work. Connect risk to everyday decisions, whatever your organisation’s size.
   • Everyday security habits — Spot the everyday shortcuts that leave information and access exposed. Build practical habits for your screen, files and workspace.

2. Session 2

   • Social engineering — Recognise requests that use fear, authority or helpfulness to rush a decision. Practise checking through a trusted contact, even when the story sounds convincing.
   • Phishing in email and messages — Check the request, sender and destination before opening a link or attachment. Apply the same judgement to email, text messages and WhatsApp.
   • Scam calls and QR-code traps — Recognise phone calls and QR codes that steer you towards a fraudulent request. Learn to verify the caller or destination independently and keep authentication codes private.
   • AI impersonation and deepfakes — A familiar voice or convincing video can still carry a fraudulent request. Practise checks that work even when an AI-generated impersonation has no obvious flaws.

3. Session 3

   • Passwords and accounts — Use distinct passwords and keep work access separate from personal accounts. Recognise requests to share a password and know what to do if it has been exposed.
   • Multi-factor authentication — Understand how an unexpected sign-in approval can become a trap. Learn to question prompts you did not initiate and keep access codes to yourself.
   • Safer email and web browsing — Spot risks in suggested recipients, reply-all messages and misleading web pages. Check where information is going before you send it or continue browsing.
   • Apps, downloads and USB devices — Recognise apps, downloads and USB devices that ask for trust too quickly. Choose approved tools and seek help before trying an improvised workaround.

4. Session 4

   • Malware and ransomware: first steps — Recognise warning signs that malicious software may be affecting your files or device. Learn the first actions that limit the problem while specialist help takes over.
   • Using AI safely at work — Understand what information belongs in an approved AI tool and what must stay protected. Check its output before using it in a document or decision.
   • Sharing information with the right people — Match the information, recipient and sharing method to the business need. Recognise requests that grant wider access or disclose more information than necessary.
   • Recognising and reporting concerns — Know what to report and how to help your organisation respond quickly, including after your own mistake. Share useful facts without spreading the exposure.

5. Session 5

   • Personal data and GDPR at work — Recognise data requests that invoke a genuine right for an unverified purpose. Apply the General Data Protection Regulation (GDPR) to everyday decisions about identity, purpose and necessary information.
   • Encryption for everyday work — Understand what encryption protects and what still needs a separate check. Use an approved method and keep the password separate from the file you send.

6. Session 6

   • Keeping and disposing of information — Recognise rushed deletion requests and equipment handovers without evidence. Check retention requirements and the approved route before disposing of information.
   • Preventing information leaks — Recognise leaks through screenshots, demonstrations and copies taken beyond their approved purpose. Limit the audience and choose appropriate information before sharing.
   • Personal data breaches — Recognise loss, disclosure or unauthorised changes involving personal data. Report internally straight away so your organisation can assess the incident and its obligations.

Delivery format

Instructor

Duration and scheduling

Materials and resources included