Global

Cyber risk governance for managers and boards

A ready-made course you customise for your organisation, with a live session deck and two surveys. You only add the 9 details that are specific to your organisation.

See the live deckSee the full outline
Try the coursePreview the survey
Length
40 min
Lessons
6 lessons
Frequency
Annually
Last reviewed
21 Oct 2026
Risk appetite and measures
What would you do?

The dashboard shows patching is 60% complete on critical systems

Try it: this is one of 19 interactive activities in the course.

What's included

Three pieces that work together

Copy once, get everything. Learners prepare on their own, you answer questions live, and the surveys tell you what stuck.

Self-paced course

Short lessons with real workplace scenarios, not walls of text.

  • 6 lessons, about 40 minutes
  • Scenario, accordion, process, sorting activity and quizzes

Live session deck

An AhaSlides presentation to run after the course, in person or online.

  • 10 slides
  • Quiz, poll, word cloud, scale slides
  • A closing slide for your contacts

Two surveys

Find out what landed, and whether people use it on the job.

  • Post-course feedback, about 2 minutes
  • 30-day check-in
  • Anonymous by default
  • Results feed your next refresher

Learning objectives

At the end of this course, learners can

Each objective and the lesson that covers it.

IDObjectiveSourceWhere it's covered
TO 198.0Achieve ≥ 80% on the final assessment-Whole course
SO 198.1Explain cyber risk as a business risk the board and leaders ownBest practice; governance guidance (see verification list)Whole course
SO 198.2Ask the five questions that show how exposed the organisation isBest practiceWhole course
SO 198.3Set a risk appetite and read a small set of cyber measuresBest practiceWhole course
SO 198.4Describe leaders' role before, during and after a major incident + your infoOrganisation's incident planWhole course
SO 198.5Know which laws and standards bring duties for leaders in your markets + your infoLaw and standards of the market (see verification list)Whole course

Your part: what a template can't do for you

  • Your workplace details: fill in the 9 highlighted fields so the course describes your own policies, contacts and locations.
  • Records: record completion in your own LMS or record system.

Course outline

6 lessons, about 40 minutes

Minutes per lesson are an estimate, shared out by page count.

ContentInteractiveVideoYou customise
1

Cyber risk is business risk

3 pages

7 min
Before you beginNoteList
The Monday morning callTextImage
Who owns this?ChecklistKey factQuiz
2

Five questions for your organisation

3 pages

7 min
The questionsProcess
Good answersAccordion
CheckSorting activityMatching quiz
3

Risk appetite and measures

3 pages

7 min
AppetiteTabs
A short dashboardAccordionText
Try itScenarioQuiz
4

Grey areas: paying, telling and trade-offs

3 pages

7 min
Decisions in a crisisAccordion
What would you do?Scenario
CheckSorting activityMulti-select quiz
5

Duties and standards

3 pages

7 min
Where duties come fromTabs
Your marketsNoteYour infoYour infoYour infoChecklist
Try itScenarioQuiz
6

Your leadership actions and the final assessment

2 pages

5 min
Next stepsProcessYour info
PracticeQuizKey factNoteButtonYour info

Live deck and surveys

10 slides to run live, two surveys to close the loop

Pink slides are interactive. Both surveys are anonymous; pink questions are written for this course.

ContentTitle, agenda, "cyber risk is business risk
PollHow ready is your organisation for a major incident?
Word cloudOne word for how cyber risk feels at board level
ContentThe five questions
QuizWho owns cyber risk? Leaders and the board with specialists ✔ · IT alone · The supplier · The insurer
QuizPatching on critical systems is 60%. What do you ask? (The plan, date and risk ✔)
ScaleHow well can you read your cyber measures?
ContentA crisis decision map
Open-ended / Q&AThe question you would ask your security lead tomorrow
Content · customiseClosing {{SECURITY_CONTACT}}, {{SURVEY_1_URL}}, {{SURVEY_2_URL}}, {{COURSE_URL}}
Post-course feedback: 11 questions, about 2 min
  1. Overall rating 5 stars
  2. Relevant, realistic, right length, helpful activities agree/disagree grid
  3. What was most useful? multi-select
  4. Confidence before this course, and now 1-5 scale
  5. Which action will you take first? multiple choice
  6. How confident are you leading in a major incident? 1-5 scale
  7. Which course should come next? ranking
  8. I know who decides in a cyber crisis. 1-5 scale
  9. One thing we should change or add open text
  10. Would you recommend this course? NPS
30-day check-in
  1. Have you used what you learned since the course? multiple choice
  2. How confident are you today? Compare with day 1 1-5 scale
  3. Do you know where to find the leader's question list? yes / no / not sure
  4. A moment where the training helped, or where you weren't sure open text
  5. Which topics should the next refresher focus on? ranking

Results show whether people use the training on the job, not just whether they finished it.

Make it yours

9 fields to fill in, and you're ready

Everything else is done. These are the details only your organisation knows; each one is highlighted inside the course.

  • Who staff ask about security questions{{SECURITY_CONTACT}}
  • Link to your information security policy{{SECURITY_POLICY_LINK}}
  • The route for reporting a security incident or suspected breach, and the time limit that applies{{INCIDENT_REPORT_ROUTE}}
  • Your data protection officer or privacy lead{{PRIVACY_CONTACT}}
  • Link to the next course in your security awareness path{{NEXT_COURSE_LINK}}
  • Where course completions are recorded{{LMS_OR_RECORD_SYSTEM}}
Show all 9 fields
  • Link to the self-paced course{{COURSE_URL}}
  • Link to the baseline survey{{SURVEY_1_URL}}
  • Link to the post-course and 30-day survey{{SURVEY_2_URL}}

FAQ

Common questions

Can I run cyber risk governance for managers and boards training online?

The course itself is self-paced and online, and the live deck lets you add a live session. Whether online delivery meets your local rules depends on the law that applies to you, so check the rules that apply to you or ask your own counsel.

How often is this training needed?

Annually, and when a regulation or major incident raises board attention.

Who needs this training?

Executives, board members and senior managers; run by L&D with the CISO or risk lead.

What records should I keep?

Record completion in your own LMS or record system, so you can show who finished the course and when. Check the retention period that applies to you in the rules that apply to you.

Can I edit the content?

Yes, everything. Change the wording, swap scenarios for ones from your workplace, add your logo, or remove parts that don't apply. Keep anything your own law requires you to cover.

Related templates

Often taught together

All Governance and risk templates →
Global

ISO/IEC 27001 and the information security management system: What every employee must know

Staff · Governance and risk

40 min
Global

Cyber incident response and breach reporting for non-specialists

All staff · Governance and risk

35 min
Last reviewed: 21 October 2026Templates are a starting point, not legal advice.

Ready to run it?

Open the live deck to see how the session runs alongside the course and both surveys.

See the live deck