Cyber incident response and breach reporting for non-specialists
A ready-made course you customise for your organisation, with a live session deck and two surveys. You only add the 7 details that are specific to your organisation.
- Length
- 35 min
- Lessons
- 6 lessons
- Frequency
- At onboarding, annually and before an incident exercise
- Last reviewed
- 21 Oct 2026
You realise you emailed a customer list to the wrong address
Try it: this is one of 21 interactive activities in the course.
What's included
Three pieces that work together
Copy once, get everything. Learners prepare on their own, you answer questions live, and the surveys tell you what stuck.
Self-paced course
Short lessons with real workplace scenarios, not walls of text.
- 6 lessons, about 35 minutes
- Scenario, process, accordion, sorting activity and quizzes
Live session deck
An AhaSlides presentation to run after the course, in person or online.
- 10 slides
- Quiz, poll, word cloud, scale slides
- A closing slide for your contacts
Two surveys
Find out what landed, and whether people use it on the job.
- Post-course feedback, about 2 minutes
- 30-day check-in
- Anonymous by default
- Results feed your next refresher
Learning objectives
At the end of this course, learners can
Each objective and the lesson that covers it.
| ID | Objective | Source | Where it's covered |
|---|---|---|---|
| TO 204.0 | Achieve ≥ 80% on the final assessment | - | Whole course |
| SO 204.1 | Recognise a possible incident and report it fast + your info | Organisation's incident route; law of the market (see verification list) | Whole course |
| SO 204.2 | Take safe first actions and avoid destroying evidence | Best practice | Whole course |
| SO 204.3 | Describe what happens after a report in plain words + your info | Organisation's incident plan | Whole course |
| SO 204.4 | Explain why time limits for notification exist, without stating them + your info | Law of the market (see verification list) | Whole course |
| SO 204.5 | Take part in a drill with a role and a checklist | Best practice | Whole course |
Your part: what a template can't do for you
- Your workplace details: fill in the 7 highlighted fields so the course describes your own policies, contacts and locations.
- Records: record completion in your own LMS or record system.
Course outline
6 lessons, about 35 minutes
Minutes per lesson are an estimate, shared out by page count.
1The first ten minutes
3 pages
7 min
The first ten minutes
3 pages
2Spotting and reporting
3 pages
6 min
Spotting and reporting
3 pages
3What happens next
3 pages
6 min
What happens next
3 pages
4Grey areas: pressure, blame and silence
3 pages
6 min
Grey areas: pressure, blame and silence
3 pages
5Drill: your role
3 pages
6 min
Drill: your role
3 pages
6Your checklist and the final assessment
2 pages
4 min
Your checklist and the final assessment
2 pages
Live deck and surveys
10 slides to run live, two surveys to close the loop
Pink slides are interactive. Both surveys are anonymous; pink questions are written for this course.
Post-course feedback: 11 questions, about 2 min
- Overall rating 5 stars
- Relevant, realistic, right length, helpful activities agree/disagree grid
- What was most useful? multi-select
- Confidence before this course, and now 1-5 scale
- Which step will you remember first? multiple choice
- How confident are you in your drill role? 1-5 scale
- Which course should come next? ranking
- I feel safe reporting a security mistake. 1-5 scale
- One thing we should change or add open text
- Would you recommend this course? NPS
30-day check-in
- Have you used what you learned since the course? multiple choice
- How confident are you today? Compare with day 1 1-5 scale
- Do you know where to find the report route and the incident checklist? yes / no / not sure
- A moment where the training helped, or where you weren't sure open text
- Which topics should the next refresher focus on? ranking
Results show whether people use the training on the job, not just whether they finished it.
Make it yours
7 fields to fill in, and you're ready
Everything else is done. These are the details only your organisation knows; each one is highlighted inside the course.
- The route for reporting a security incident or suspected breach, and the time limit that applies
{{INCIDENT_REPORT_ROUTE}} - Your data protection officer or privacy lead
{{PRIVACY_CONTACT}} - Link to the next course in your security awareness path
{{NEXT_COURSE_LINK}} - Where course completions are recorded
{{LMS_OR_RECORD_SYSTEM}} - Link to the self-paced course
{{COURSE_URL}} - Link to the baseline survey
{{SURVEY_1_URL}}
Show all 7 fields
- Link to the post-course and 30-day survey
{{SURVEY_2_URL}}
FAQ
Common questions
Can I run cyber incident response and breach reporting for non-specialists training online?
The course itself is self-paced and online, and the live deck lets you add a live session. Whether online delivery meets your local rules depends on the law that applies to you, so check the rules that apply to you or ask your own counsel.
How often is this training needed?
At onboarding, annually and before an incident exercise.
Who needs this training?
All staff, with an incident-team variant as a note; run by L&D with the security and privacy leads.
What records should I keep?
Record completion in your own LMS or record system, so you can show who finished the course and when. Check the retention period that applies to you in the rules that apply to you.
Can I edit the content?
Yes, everything. Change the wording, swap scenarios for ones from your workplace, add your logo, or remove parts that don't apply. Keep anything your own law requires you to cover.
Related templates
Often taught together
Cyber risk governance for managers and boards
Executives · Governance and risk
ISO/IEC 27001 and the information security management system: What every employee must know
Staff · Governance and risk
Ready to run it?
Open the live deck to see how the session runs alongside the course and both surveys.