The NCSC training video is mandatory, but it is not enough to protect your school
Your school has watched the NCSC cyber security training video. Your staff and governors have completed it. You have evidence for your RPA cover and DfE Cyber Security Standards compliance.
Did you know, there is now a better way to evidence it.
GoldPhish has added the NCSC training video to its training library, which means schools can assign it to staff and governors, track who has watched it, monitor completion, and produce reports for RPA and DfE Cyber Security Standards evidence.
That is a big improvement for schools, but here is the problem – compliance and protection are not the same thing.
Somewhere right now, a member of staff is about to click a phishing link that could cost their school thousands of pounds. Not because they are careless. Not because they are the “weakest link” (please do not use that term). But because a single training video, however important, does not automatically change behaviour.
This is not a criticism of the National Cyber Security Centre. Their training is a genuine requirement and a useful foundation. If your school has not delivered it yet, it should be a priority.
But if you are a head teacher, business manager or trust leader treating it as your complete security awareness strategy, your school may still be exposed.
The NCSC video: required, valuable and easier to evidence
Let’s be clear from the start.
Your staff and governors should complete the NCSC cyber security training video. It supports the DfE Cyber Security Standards and is linked to RPA requirements. Schools need to be able to show that the training has been completed.
Previously, this could be awkward.
Some schools relied on spreadsheets, emails, manual declarations or screenshots. That can become messy very quickly, especially when you are trying to evidence completion across staff, governors, new starters and role changes.
GoldPhish now makes this easier because the NCSC video is available in its training library. That means schools can:
Assign the NCSC video to staff and governors
Track who has completed it
Report on completion for RPA evidence
Support DfE Cyber Security Standards compliance
Keep a clearer audit trail
That is useful. It turns a manual compliance task into something much easier to manage.
But it still does not make the NCSC video a complete cyber security awareness programme.
Why the video is not enough on its own
The NCSC video is a strong baseline, but it has limitations if used in isolation.
1. It is passive, not behavioural
Watching a video raises awareness in the moment. It does not always change what someone does when a convincing phishing email lands in their inbox on a busy Monday morning.
The real risk is not whether staff have heard of phishing. Most have.
The real risk is whether they pause before entering their Microsoft 365 password into a fake login page.
That takes repetition, context and practice.
2. It is a one-off, not a programme
Cyber threats change constantly.
Schools are now dealing with convincing phishing emails, fake invoices, compromised supplier accounts, QR code scams, malicious attachments and AI-assisted messages that are much harder to spot.
A single video gives people a foundation. It does not keep them sharp throughout the year.
Good security awareness training is ongoing. It gives people small, regular reminders before the real attack arrives.
3. Completion is not the same as understanding
GoldPhish can now help you track and report who has completed the NCSC video, which is excellent for compliance evidence.
But completion is only one part of the picture.
You also need to know whether staff are becoming more resilient. Are phishing clicks reducing? Are people reporting suspicious emails? Are high-risk users getting extra support? Are finance and admin staff receiving training linked to the risks they actually face?
That is where a wider security awareness programme becomes important.
The framework schools actually need: awareness, behaviour, culture
Most cyber security conversations in schools stop at awareness.
“Staff have watched the video.”
That is a useful start. But awareness on its own is not enough.
The goal is not for staff to know that phishing exists. The goal is for them to pause before clicking, question unexpected requests, report suspicious emails, and feel confident asking for help.
That shift needs three things working together:
Repeated, relevant learning
Safe phishing simulations
Measurable progress over time
This is where platforms such as GoldPhish, usecure, Huntress SAT and CyberSmart can help.
They support ongoing training, reporting and simulated phishing exercises. They help schools move from “we told people once” to “we are actively improving behaviour and reducing risk”.
“But we have a limited budget”
This is the objection every school business manager raises, and it is fair.
Schools are under pressure. Budgets are tight. Cyber security can feel like one more thing on an already impossible list.
But the cost of doing nothing is much higher.
A ransomware incident, Microsoft 365 compromise or successful phishing attack can cause major disruption. It can affect safeguarding, finance, payroll, parent communications, lessons, exams, data protection and public trust.
The NCSC video is free and mandatory.
GoldPhish now gives schools a practical way to track it and report on it.
But schools should not stop there.
A proper awareness programme does not need to be expensive or enterprise-level. It needs to be proportionate, measurable and consistent.
What schools should do this week
If you are a head teacher, school business manager or trust leader, start with these five steps.
1. Confirm your NCSC training evidence
Have all staff and governors completed the NCSC cyber security training video?
If you are using GoldPhish, assign the video from the library, track completion and keep the report as evidence for RPA and DfE Cyber Security Standards compliance.
2. Check your records
Can you prove who completed the training, when they completed it, and whether new starters are included?
If the answer is “it is probably in a spreadsheet somewhere”, that is a sign your process needs tightening.
3. Add ongoing awareness training
Do not rely on one annual video.
Use short, regular modules that cover the threats schools actually face, including phishing, password reuse, MFA fatigue, invoice fraud, fake QR codes, data handling and reporting suspicious emails.
GoldPhish has a range of training videos in its library that can complement the NCSC video, helping schools cover topics such as phishing, password security, social engineering, data protection and safe online behaviour.
This gives staff regular reminders, helps reinforce safer habits, and provides better evidence that cyber awareness is being treated as an ongoing programme rather than a one-off compliance task.
4. Run phishing simulations safely
A good phishing simulation should not shame staff. It should help them learn.
The aim is not to catch people out. The aim is to understand risk, support staff and build safer habits.
5. Prioritise higher-risk roles
Some staff have access to more sensitive systems than others.
Finance teams, office managers, senior leaders, safeguarding leads and IT administrators often need more targeted training because the impact of compromise is higher.
Treat the NCSC video as the floor, not the ceiling
The NCSC cyber security training video deserves its place.
It gives staff and governors a common baseline. It supports DfE Cyber Security Standards compliance. It helps protect RPA cover. And now, with GoldPhish including the video in its library, schools have a much better way to assign it, track it and report on completion.
That is good news.
But it is still the floor of your cyber awareness strategy, not the ceiling.
Real security awareness training changes behaviour. It gives staff regular reminders. It measures progress. It helps people report suspicious activity quickly. It builds a culture where cyber security feels like part of everyday school life, not a once-a-year compliance exercise.
Your staff are not the weakest link.
With the right support, they can be one of your strongest lines of defence.
If you would like help evidencing your NCSC training, improving your RPA and DfE Cyber Security Standards position, or building an awareness programme that actually changes behaviour, get in touch with Black Swan Cyber Security Solutions.
We can help you choose the right approach for your school, your budget and your level of risk.
