Module 3 — Cyber Literacy for Managers
For the people who approve, defer or decline cyber work.
Staff awareness training teaches people not to click the link. This teaches the person who signs off the budget what they are actually approving — and what they are accepting when they say no.
- Explain a cyber risk to a board or an owner without using jargon
- Read a technical recommendation and identify what is missing from it
- Decide on cyber work using consequence, not just cost
- Say no to a recommendation properly, and record why
- 7 lessonsIncluded
- Decision scenariosIncluded
- Insurance question translatorIncluded
- Incident first-response drillIncluded
- Certificate on completionIncluded
What is in the module
Lesson by lesson
- 1
What cyber risk actually means for a business
Moving from "we might get hacked" to the specific outcomes that cost money: downtime, fraud, data loss, privacy breach, insurance disputes and reputational damage.
- 2
What IT controls, and what it does not
A clear split. Your IT provider can configure a control. They cannot approve a budget, enforce a policy, or tell you a staff member left last Friday.
- 3
How managers actually make cyber decisions
A repeatable way to weigh urgency, cost, effort and consequence — and how to say no properly when no is the right answer.
- 4
How to read a recommendation
What good looks like: a plain-English explanation, a stated business risk, an impact if ignored, a named owner and a cost. What to push back on when it is missing.
- 5
What cyber insurance questions are really asking
Application questions are control checklists in disguise. We translate the common ones and explain what answering "yes" commits you to evidencing.
- 6
Staff responsibility and where it stops
Why "the staff member clicked it" is rarely the root cause, and what a manager is genuinely accountable for.
- 7
Incident first response for managers
The first sixty minutes. Who you call, what you must not do, what to write down, and who needs to be told.
Module details
- Audience
- Managers, owners and decision-makers
- Duration
- About 25 minutes
- Pass mark
- 80% to pass
- On completion
- Verifiable certificate
- Format
- Lessons, scenarios, quiz
The full module, its scenarios, the quiz and the certificate live inside the platform. Our blog covers these topics at a high level for free — but the training itself is not published publicly.
See plans that include itWhat people can do afterwards
Outcomes, not attendance
- Explain a cyber risk to a board or an owner without using jargon
- Read a technical recommendation and identify what is missing from it
- Decide on cyber work using consequence, not just cost
- Say no to a recommendation properly, and record why
- Answer a cyber insurance application honestly and evidence it later
- Know exactly what your IT provider is and is not responsible for
- Run the first hour of an incident without making it worse
- Know which questions to ask before approving cyber spend
A scenario from the module
The recommendation you have to decide on
Your IT provider emails: “We recommend enabling conditional access policies with device compliance enforcement across the tenant. Estimated 6 hours at standard rate.” There is no explanation of what happens if you do not do it, no indication of urgency, and no mention of what changes for staff. Your budget is tight this quarter.
What are the three questions you should send back before you approve, defer or decline this — and which one determines your answer?
The answer, the explanation and the rest of the scenarios are inside the module.
Who it is for
Assign it to the right people
Owners and directors
The people who ultimately carry the risk, and who are asked to explain the decision afterwards.
Operations and practice managers
The people who field the IT provider’s recommendations and decide what happens next.
Finance leads
The people who see the cost of a recommendation before they see the cost of not doing it.
Free vs paid
What you can read for free, and what needs an account.
Free on the blog, no account needed
Understand the issue. Genuinely useful, genuinely free.
- Why cyber security is not just an IT problem
- What cyber insurance questions are really asking, at a high level
- Why cyber security feels confusing for small business managers
- General guidance on when to seek professional support
Inside the platform, with a paid account
Act on the issue, and have a record that you did.
- The full seven-lesson manager module with decision scenarios
- The quiz, pass mark and certificate
- The client responsibility matrix showing who owns what
- The cyber readiness score across twelve areas
- The cyber action plan with approve, defer and decline workflows
- Management reporting and evidence records
Training is one stage of five
Where this module sits in the wider platform.
A module on its own teaches. It becomes a risk control when it is assigned off the back of an assessment gap or a failed simulation, and when the completion ends up in an evidence record.
Assessments
Find the gaps that tell you which training to assign in the first place.
Phishing simulations
Test whether it stuck, and assign follow-up training automatically.
How the training works
Scenario decisions, measured competencies, badges and the full catalogue.
Reporting and evidence
Verifiable certificates and completion records for insurers and clients.
Your staff are trained. Are the people making the decisions?
See the manager module, the responsibility matrix and the readiness score in a short walkthrough.