Free cyber awareness training for your staff
What it is
Lessons from IT is a free cyber security awareness course for everyone in your business, not just the IT people. It’s eight short memos, about 45 minutes in total, written in plain English with real examples from incidents I’ve worked on.
- Each memo has a short story, a hands-on activity and a 5-question check (4 out of 5 to pass).
- Staff get a certificate at the end, which they can print or save as a PDF.
- No sign-up and no personal details collected. Progress is saved in each person’s own browser.
- Works on phones, tablets and laptops.
How to roll it out
1. Send your team the link.
https://learn.fromit.co.uk/2. Ask everyone to send you their certificate when they’ve finished. Keep the PDFs in a folder as your training record.
3. Repeat it every year, and add it to your new starter checklist so it happens in their first week.
Here’s a message you can paste into an email or Teams:
What it covers
The memos follow the five Cyber Essentials controls, the UK government-backed baseline for protecting a business against the most common attacks.
| Memo | What staff learn | Cyber Essentials control |
|---|---|---|
| 00 Why would anyone hack us? | Why every business is a target, and what criminals are after | All five |
| 01 That email isn’t from your boss | Phishing, invoice fraud, fake “quick favours” | Malware protection, user access control |
| 02 Your password is probably Summer2026! | Passphrases, password managers, MFA | User access control |
| 03 Yes, you do have to restart | Updates within 14 days, screen locks, unsupported devices | Security update management, secure configuration |
| 04 Where did you download that? | Malware, approved software, macros, found USB sticks | Malware protection, secure configuration |
| 05 The café Wi-Fi isn’t your friend | Public Wi-Fi, firewalls, home working, lost devices | Firewalls, secure configuration |
| 06 Who has the keys? | Admin accounts, least access, starters and leavers | User access control |
| 07 Something’s wrong. Now what? | Spotting an incident and reporting it fast, without blame | All five |
Will it help with Cyber Essentials?
Cyber Essentials is mostly technical. It checks your devices, accounts and settings, but the question set also asks how you help staff with things like creating strong passwords. And the controls only keep working if people use them well: accepting updates, using MFA, not switching off protection, and speaking up quickly. This course covers all of that.
If you’re working towards certification, the fromIT Cyber Essentials packages cover the technical side, with fixed prices and support through the assessment.
Insurers, clients and ISO 27001
Cyber insurers and supplier questionnaires often ask whether staff have had security awareness training. A folder of dated certificates is a simple, honest answer.
For ISO 27001, awareness training is a requirement (Annex A 6.3), and your certificates are evidence that it happened. Repeat it yearly to keep the record current.
Questions
Is it really free? Yes. No sign-up, no trial, no catch.
Can I see who has finished? Not yet. Collect certificates by email for now. Team tracking for managers is planned.
Something has already gone wrong? fromIT runs a same-day cyber incident response line.