Last reviewed 4 November 2026 against the sources linked in this post.
The board meets on Thursday, and the chair has one question for the CISO: "If we were hit by ransomware tomorrow, who decides what, and have we practised it?" The tools matter, but the answer depends on governance, drills and staff who report fast. That is what cyber security training for executives has to cover. NIST made the point in its Cybersecurity Framework 2.0, which added a sixth function, Govern, covering roles, responsibilities and authorities, policy and the oversight of cybersecurity strategy.
This list gives a CISO the courses to run that programme. You get 10 ready-made courses in 3 groups, what each fixes and how to roll them out. Each group ends with an Our pick. The legal points describe US federal rules, so use this as a syllabus, not a ruling.
All 10 courses at a glance
| Course | What it covers | Length | Law behind it? |
|---|---|---|---|
| Cyber risk governance for managers and boards | Five board questions, risk appetite and crisis decisions | 40 min | No |
| IT governance, enterprise architecture and IT audit: COBIT and TOGAF | Governance objectives, architecture method and audit planning | 45 min | No |
| ISO/IEC 27001 and the ISMS | Policy to practice, exceptions and talking to an auditor | 40 min | No |
| Ransomware tabletop for managers | The first hour, who decides and who speaks, backups | 60 min | No |
| Insider threat awareness | Risk indicators, recruitment methods and reporting | 30 min | Yes (US cleared contractors) |
| Security awareness essentials | The stages of an attack and core habits | 35 min | Yes (US covered financial institutions) |
| Phishing & social engineering | Red flags, verification and reporting | 30 min | No |
| Passwords, passkeys and multi-factor authentication | Safe sign-ins, MFA, passkeys and recovery | 30 min | No |
| AI security for everyone | Shadow AI, prompt injection and manipulated outputs | 30 min | No |
| Social engineering, fraud and deepfakes | Phone, payment and impersonation scams | 35 min | No |
Two courses sit on a US federal rule, and only for some organisations. Under the NISPOM rule, cleared defence contractors must give newly cleared employees insider threat awareness training before granting access to classified information and validate initial and annual completion. The FTC Safeguards Rule says covered financial institutions must provide security awareness training to their personnel. Neither sets a course for everyone else.
Governance and frameworks
Cyber risk governance for managers and boards
This 40-minute course treats cyber risk as business risk. It covers five questions to ask about your organisation, risk appetite and a short dashboard, the grey areas of paying, telling and trade-offs, where duties come from, and the leadership actions to take next. A CISO can run it with the leadership team before a board cycle. The "a dashboard shows hundreds of measures" question works as a Pick Answer slide and starts the right argument. Board members get their own list in our board of directors training guide.
IT governance, enterprise architecture and IT audit frameworks: COBIT and TOGAF
This 45-minute course opens with "a system nobody was accountable for", then covers why IT governance matters for value, risk and resources, governance versus management objectives, the architecture development method, maturity models and planning an IT audit with a report to leadership. It gives IT managers who report to the CISO a shared frame. The "governance or management?" sorting activity makes a quick Pick Answer round.
ISO/IEC 27001 and the information security management system
The CISO usually owns the ISMS, and every employee is part of it. This 40-minute course explains what an ISMS is, how policy becomes practice, how exceptions and weaknesses are handled and how to talk to an auditor. Roll it out before a certification or surveillance audit so staff can answer questions with evidence. An Open Ended slide on "what would you show an auditor?" surfaces the gaps early.
Our pick: Cyber risk governance for managers and boards. It turns NIST's Govern function into five questions a leadership team can answer, which is the conversation most CISOs need first.
Incident readiness and insider risk
Ransomware tabletop for managers
This 60-minute course is a tabletop in three parts: the first hour, decisions and communication, and backups and fixes. Managers practise who isolates machines, who speaks to the press and who decides about a ransom, which the course answers as leadership with legal advice. It ends with a 7-question final check. Run it live with the real names of your incident lead and communications head. For the analysts who carry out the plan, see our SOC analyst training list.
Insider threat awareness
Insider threat programmes often sit with the CISO, from detection to response. This 30-minute course covers why detection matters, behavioural, technical and financial indicators, how adversaries recruit trusted insiders, what to do and not do, and where to report. It ends with a 10-question final check at 80% to pass. For cleared US contractors it is a ready-made way to deliver the training the NISPOM rule above requires, though the rule names no course.
Our pick: Ransomware tabletop for managers. A plan nobody has rehearsed fails in the first hour, and this tabletop makes leaders decide before the pressure is real.
Staff security habits and AI risk
Security awareness essentials
This is the baseline awareness programme a CISO is accountable for. The 35-minute course covers why people are targeted, the anatomy of an attack, red flags, how to protect yourself and how to respond and report, with a 12-question final check at 80% to pass. For covered financial institutions it is a ready-made way to meet the FTC Safeguards Rule's security awareness training requirement, though the rule names no course.
Phishing & social engineering
Phishing resilience is a common CISO metric. This 30-minute course explains how attacks are built, the red flags, how to protect yourself and how to report, with a 12-question final check at 80% to pass. Pair it with your reporting button so the course and the metric match.
Passwords, passkeys and multi-factor authentication for staff
Rolling out passkeys and MFA is a programme decision, and staff need to know why. This 30-minute course covers why accounts are the target, strong and unique sign-ins, multi-factor and passkeys, fake sign-in pages and the grey areas of sharing, shortcuts and recovery. Launch it the week a new sign-in method goes live.
AI security for everyone: shadow AI, prompt injection and manipulated outputs
AI security policy for shadow AI and prompt injection increasingly falls to the CISO. This 30-minute course covers shadow AI and a compromised chatbot, prompt injection and poisoned content, hidden instructions in PDFs and emails, free AI extensions and how to request an approved tool or report an incident. A Word Cloud on "which AI tools do you use at work?" shows the shadow AI you did not know about.
Social engineering, fraud and deepfakes: phone, payment and impersonation scams
Deepfake and impersonation fraud belongs in every executive threat briefing, because executives' names and voices are what attackers imitate. This 35-minute course follows a convincing request, covers the tactics, verifying payment changes, faked voice and video, and why seniority and secrecy are pressure, not proof. Run it with finance and the executive assistants first.
Our pick: AI security for everyone. Staff often adopt AI tools faster than policy can follow, and this course gives them a simple request, use, check and report loop.
How to roll the plan out
Start with governance. NIST's CSF 2.0 puts Govern first: executives set expectations on risk appetite, accountability and resources, and the rest of the programme follows from them.
- This quarter, for leaders: cyber risk governance, then the ransomware tabletop with the people named in your incident plan.
- For every employee, at onboarding: security awareness essentials, phishing, and passwords, passkeys and MFA.
- For IT and security managers: COBIT and TOGAF, and ISO 27001 before your next audit.
- Each year: rerun the tabletop, a refresher quiz on each course, and the AI security course whenever a new AI tool is rolled out.
- When it applies: cleared US defence contractors give insider threat training before access to classified information and every year after; covered financial institutions keep security awareness training current as the FTC Safeguards Rule describes. Ask your counsel what else applies in your country or state.
Ways to run these courses on AhaSlides
You can build any of these as a self-paced course with the AhaSlides course creator, run them as a live Q&A session deck, or both, with a post-course survey to see what changed.
- Pick Answer: in the tabletop, show the ransom note and ask who decides the next step.
- Word Cloud: ask leaders "What worries you most about a cyber incident?" and compare it with your risk register.
- Rating Scale: before and after, ask "How ready is our incident plan?" from 1 to 5.
- Open Ended: collect anonymous questions for the board at the end of a live session.
FAQ
What training does a CISO need?
A CISO needs risk and governance, incident response leadership, knowledge of the rules that apply and the skill to brief a board. The courses above cover the programme a CISO runs; certifications cover the personal credential.
What certifications do CISOs have?
Common ones include CISSP, CISM and the EC-Council CCISO. None of the courses above is a certification.
How often should leaders run incident exercises?
At least once a year is a sensible baseline, and again after a major change such as a merger, a new system or a new incident lead.
What is a ransomware tabletop?
A ransomware tabletop is a discussion-based exercise that rehearses the decisions leaders make during a ransomware attack, without touching live systems.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
