Tailgating is tested at the door, and we have spent years on doors. From October 2018 to November 2022 we ran corporate security and reception for Experian UK: 22 officers including one supervisor and one manager, a 24/7 control room, and access control across 20 Experian UK locations nationally. That guarding was a separate service from any awareness training, and we are not claiming otherwise. Our view of training comes from that door: it only counts if it changes what people do there and at the keyboard.
Security awareness training works best as a scheduled cycle rather than a one-off session. A typical 12-month design maps five named staff behaviours to NCSC’s Top Tips for Staff, ISO/IEC 27001:2022 Annex A control 6.3, and the Data Protection Act 2018, then runs a cohort workshop in week four, phishing-awareness exercises, a refresh in month six, and a close-out evidence pack in month twelve. No standard sets that 12-month shape; it is one way to organise the evidence. Our SIA ACS approval (ref ELSELISC02) covers security guarding, and the SIA does not approve training providers, so it says nothing about training quality. Judge any provider on its own evidence, and judge us the same way.
What does the training change on site?
The training aims to change five staff behaviours: phishing recognition, tailgating refusal, social-engineering resistance, incident reporting, and data handling. Each can map to a named reference you can audit.
Phishing and social engineering map to NCSC guidance and ISO/IEC 27001:2022 Annex A control 6.3. Tailgating maps to physical-entry controls and the UK GDPR security principle, which the Data Protection Act 2018 sits alongside. Incident reporting maps to the Information Commissioner’s Office rule that notifiable personal data breaches are reported within 72 hours of becoming aware of them.
How does the 12-month engagement run?
An example UK commercial-property programme might run to a calendar like this. Kick-off happens within five working days; the cohort workshop lands in week four; the first phishing-awareness exercise follows around week twelve. A mid-year refresh sits at month six, with two more exercises in months nine and twelve. The close-out report reaches the sponsor in month twelve, carrying the click-rate change and anonymised incident volume. We offer these dates as a template to negotiate, not an industry rule.
Why should the engagement name an accountable lead?
The engagement should name an accountable lead because the curriculum has to evidence its alignment to NCSC guidance, ISO/IEC 27001:2022, and data protection law. An unnamed trainer cannot produce that evidence for an insurer, an ICO audit, or a board risk committee. Our advice is to ask any provider to name the individual and to show evidence of any professional credential they claim.
How is the training measured?
You can measure the training against three criteria: the phishing click-rate change between the baseline and each exercise; the change in incident-reporting volume, as anonymised tickets; and control-mapping evidence against ISO/IEC 27001:2022 Annex A control 6.3. Cyber Essentials is a separate matter. It certifies five technical controls (firewalls, secure configuration, security update management, user access control and malware protection), so a training evidence pack is not a Cyber Essentials requirement.
Do phishing simulations work, and what are the risks?
The NCSC says no training package, including phishing simulations, can teach users to spot every phishing attempt. It advises treating user education as one layer alongside technical measures, and warns that simulations can create legal risk, so check with HR first. We would use exercises to learn and to encourage reporting, and never to blame people who click.
The NCSC’s phishing guidance sets out four layers: make it difficult for attackers to reach users, help users identify and report suspected phishing, protect the organisation from undetected phishing emails, and respond quickly to incidents. It sets no frequency for simulations.
What should the fee cover?
We would ask the fee to cover the cycle end to end: kick-off, cohort workshop, the agreed number of exercises, the mid-year refresh, the named lead, and both evidence packs. Pricing per cohort rather than per head is one option, because the workshop, simulation licences, and reporting pack are fixed costs; confirm the basis in writing. When you compare quotes, ask whether the quote carries the simulation evidence or only the workshop day.
How to compare quotes on the same terms
We would compare on the cycle, not the day rate. A one-off e-learning module costs less but gives you a single data point. ISO/IEC 27001 expects an awareness programme for personnel, so ask your certification body what evidence it wants to see. The NCSC offers a free e-learning package that takes under 30 minutes, which makes a useful baseline. Check whether the quote names the lead, the five behaviours, the number of exercises, and who receives the month-twelve evidence pack.
We cover the vetting questions in how to choose security awareness training, and the SLA and exit clauses in security awareness training contract terms. Our London coverage supplies manned guarding for city-centre property.
Frequently asked questions
There is no fixed UK interval set by the NCSC or by ISO/IEC 27001:2022. We would suggest an annual workshop with a refresh around month six and periodic exercises, reviewed against your own reporting and incident data. Choose an interval you can evidence and maintain.
No. Training is not an SIA-licensable activity, and the SIA's Approved Contractor Scheme does not approve training providers. Our SIA ACS approval (ref ELSELISC02) covers security guarding. Ask any training provider, us included, for evidence of its own credentials and of how its content maps to NCSC guidance and ISO/IEC 27001:2022.
Partly. E-learning, such as the NCSC's free Top Tips for Staff package, can carry the theory and a baseline. A facilitated workshop and debriefs after any exercise add discussion that e-learning cannot. Whether you deliver on site or remotely depends on cohort size and the sites involved.
