SETA & Compliance Training
Your people are your biggest security risk. They're also your most powerful defence.
​
Most cyberattacks succeed because of human error — a phishing link clicked, a password reused, sensitive data shared carelessly. Technical controls alone don't fix this. The answer is a workforce that understands the threats they face and knows how to respond. That's what SETA delivers: structured, ongoing security education that changes behaviour, not just awareness.
Cybersecurity Awareness Training — General Staff
The foundational training every organisation needs. We make security understandable for people who aren't technical — covering the threats they'll actually encounter at work, the habits that protect them, and what to do if something goes wrong. This isn't a tick-box exercise. It's practical, memorable, and tailored to your industry and team size.
This programme also serves as the staff awareness component required by most compliance frameworks — including SOC 2 CC9.1, ISO 27001 Annex A.7.2.2, and Cyber Essentials — helping you satisfy auditor requirements and build a documented training record at the same time.
​
THIS IS RIGHT FOR YOU IF…
-
You have no formal security awareness programme and need to build one
-
A compliance audit requires evidence of staff security training
-
Your team has grown and you need consistent security knowledge across the organisation
-
You want an annual refresher your whole team can complete, with certificates of completion
What to expect:
-
​​​Live Virtual
-
On-Site
-
Set-paced Modules
-
Completion certificates included​​
​​
Includes:​​
-
Phishing, social engineering, and email threats
-
Password hygiene and access management
-
Safe data handling and storage practices
-
Incident recognition and reporting procedure
-
Remote working and device security
-
Documented training record for audit evidence
​
​
​​​
From $450
Per session: Group pricing and annual programme packages available
Cybersecurity for Health Workers — Clinical & Non-Clinical
Healthcare organisations are among the most targeted in the world. Patient records sell for up to 50× the price of financial data on the dark web, and a successful attack doesn't just cost money — it puts lives and livelihoods at risk.
This programme is built specifically for the healthcare environment. It speaks the language of clinical and administrative staff — not IT professionals. No jargon. No assumptions about technical knowledge. Content is mapped directly to healthcare-specific obligations including NHS Data Security and Protection Toolkit (DSPT), HIPAA (for US-facing organisations), and GDPR as it applies to special category health data. We train your people on the specific risks they encounter in clinical settings — from accessing patient records on shared devices to handling data requests from third parties.
​
THIS IS RIGHT FOR YOU IF…
-
You're an NHS-affiliated organisation, GP practice, or independent healthcare provider needing DSPT-aligned training
-
Your clinical staff access patient records digitally and have had no formal cybersecurity training
-
You handle special category health data and need staff to understand their GDPR obligations
-
You've experienced or nearly experienced a patient data incident and want to prevent recurrence
-
You run a private clinic, care home, or health tech company handling patient or service user data
​
What to expect:
-
Live Virtual
-
On-Site
-
Separate clinical and admin tracks
-
DSPT-aligned certification
​
​
Includes:​​
-
NHS DSPT mandatory requirements — what they mean in practice
-
Safe use of patient record systems (EPR/EHR)
-
GDPR for health data — what staff can and cannot do
-
Phishing and social engineering in healthcare settings
-
Data breach recognition and mandatory reporting
-
Secure use of mobile devices and shared clinical workstations​
​
​​​
From $650
Per session: Per-head pricing for large teams · annual programme packages available
SOC 2 Compliance Awareness Training
​SOC 2 is one of the most common compliance frameworks for technology companies — and it requires documented evidence that your staff understand security policies and their responsibilities under your Trust Services Criteria. This isn't optional: auditors look for it specifically, and missing or insufficient training evidence is one of the most common reasons organisations fail or delay their SOC 2 Type II audit.
We deliver tailored awareness training aligned to your SOC 2 programme — covering the policies your team is expected to follow, and providing the documentation your auditor needs to see.
​
THIS IS RIGHT FOR YOU IF…
-
You're pursuing SOC 2 Type I or Type II and need staff training as part of your evidence pack
-
Your auditor has flagged a gap in staff awareness training or training records
-
You want training that maps directly to your specific Trust Services Criteria (CC, A, C, PI, P)
-
You need annual retraining and documentation for ongoing SOC 2 maintenance
What to expect:
-
Live Virtual
-
Self-Paced (For distributed teams) ​
-
Auditor-ready training records
-
Annual refresh available​
​​
Includes:​
-
​​What SOC 2 means and why it matters to your team
-
Your organisation's security policies and expected behaviours
-
Handling sensitive data under your Trust Services Criteria
-
Access control and least-privilege practices
-
Incident recognition and escalation procedures
-
Signed acknowledgement and completion records for auditors
​
​
​​​​​
From $750
Per session: Annual maintenance pricing available
ISO 27001 & ISMS Awareness Training
​ISO 27001 certification isn't just about having the right policies — it requires that your people understand the Information Security Management System (ISMS) and know their role within it. Annex A.7.2.2 (Security awareness, education, and training) is a mandatory control, and certification bodies expect evidence of a structured, recurring training programme.
We build and deliver awareness training aligned to your ISMS — translating technical requirements into practical, role-appropriate guidance your whole workforce can act on.
​
THIS IS RIGHT FOR YOU IF…
-
You're implementing ISO 27001 and need staff training as part of your ISMS rollout
-
Your certification audit is approaching and you need documented awareness training evidence
-
You've achieved certification and need an annual training refresh for ongoing surveillance audits
-
Staff turnover means new employees need onboarding into your ISMS and security obligations
​​
What to expect:
-
Live Virtual
-
On-Site
-
Auditor-ready training records
-
Annual surveillance refresh
​
​
Includes:
-
What ISO 27001 and your ISMS mean for staff day-to-day
-
Information classification and handling obligations
-
Acceptable use of company systems and data
-
Risk reporting and escalation under your ISMS
-
Physical and environmental security responsibilities
-
Signed completion records for certification body evidence
​
​
​​​
​​​​
From $750
Per session: Annual refresh packages available
Cyber Essentials+ Staff Readiness Training
Cyber Essentials Plus (CE+) includes a technical assessment — but it also evaluates how staff behave with company devices and data. Assessors look at what happens in practice, not just what's written in policy. If your team is unaware of the requirements — patching their devices, not using personal software on company hardware, keeping systems updated — you risk failing an assessment that your policies suggest you should pass.
Our CE+ readiness training prepares your workforce for exactly what assessors check, in plain English, before the assessment date.
​
THIS IS RIGHT FOR YOU IF…
-
You're pursuing Cyber Essentials Plus and need your staff ready before the technical assessment
-
You bid for UK government or public sector contracts that require CE+ certification
-
Your staff use company devices but aren't aware of their responsibilities under CE+
-
A previous CE+ attempt was undermined by staff behaviour rather than technical controls
​
What to expect:
-
Live Virtual
-
On-Site
-
Typically 2-3 hours
​
​
Includes:
-
What CE+ assessors look for from staff
-
Device and software management responsibilities
-
Patching, updates, and why they matter
-
Boundary firewall and access control behaviours
-
Safe internet use and malware prevention
​
​
​​​
From $550
Per session: Best paired with our CE+ Audit Readiness advisory
​
​
​
AI Awareness & Acceptable Use Training
Your staff are almost certainly already using AI tools — whether you've sanctioned them or not. Shadow AI (staff using tools like ChatGPT with sensitive company or client data, without IT or legal awareness) is one of the fastest-growing data governance risks businesses face.
This programme ensures your team understands what they can and cannot do with AI tools at work, why the boundaries exist, and what to do when they're unsure. It's paired with the AI Governance Advisory service above for organisations that need both a policy framework and staff training to match.
​
THIS IS RIGHT FOR YOU IF…
-
Staff are using AI tools at work without formal guidance or policy
-
You've recently introduced an AI acceptable use policy and need staff to understand it
-
A client or auditor has asked how you manage AI use in your organisation
-
You want to enable productive AI use without creating legal, compliance, or data risks
​
What to expect:
-
Live Virtual
-
Self-paced module
-
Refreshed as regulation evolves
​
​
Includes:
-
What shadow AI is and why it's a risk
-
Your organisation's AI acceptable use policy in plain English
-
What data must never be entered into AI tools
-
How to use AI tools productively within approved boundaries
-
EU AI Act obligations that apply to staff
​
​
​​​
​​​​
From $450
Per session:
Bundle pricing with AI Governance Advisory available
ADD-ON · START HERE
Phishing Simulation & Response Testing
The best way to test whether training is working. We run simulated phishing campaigns against your team, identify who clicks, and use the results to target your next training session where it's most needed. This can also serve as a baseline assessment before any SETA programme begins.
From $350
Per campaign · reporting included
WHO CAN WE HELP?
Healthcare
Healthcare organisations — clinical and non-clinical staff
ORGANISATIONS
Organisations with no existing security training programme
BUSINESSES
Businesses that have grown fast and outpaced their original training
SMBS
SMBs pursuing compliance certification
TEAMs
Teams working toward SOC 2, ISO 27001, or Cyber Essentials+