Cyber Security Awareness Training Dublin Employers: What NCSC Guidance Says

If you are looking for cyber security awareness training Dublin employers can justify to a manager or an insurer, the most useful official starting point is the National Cyber Security Centre (NCSC) in Ireland. Its published material recommends that staff are trained, but the pages we read present this as guidance, not as a legal rule that sets a number of hours or a named course. This article separates the two. If your team also handles payments, see our guide to cybersecurity training for finance professionals.

Everything below comes from pages we opened on ncsc.gov.ie on 9 October 2026. Where a page shows a date, we give it. Where it does not, we say so.

Guidance versus legal duty

This is the most common point of confusion, so it comes first.

• Guidance: the NCSC documents we read (the small business guide, the 12 Steps document and the business email compromise guidance) describe recommended measures. The small business guide presents them as best practice.
• Legal duty: some rules do apply to some organisations, for example data protection law and, in future, the NIS2 Directive for organisations that fall within its scope. Those are set by legislation, not by the NCSC guides, and they are covered in separate sections below.

If a training supplier tells you a specific course is mandatory for all employers, ask them to point to the law. The NCSC pages we read do not say that.

What the NCSC small business guidance says about staff

The NCSC publishes a document titled "Cyber security for small business". The copy we opened shows no publication date, although it refers to 2024 threat reports. It describes employees with good practices as "your first defence against cyber-attacks" and recommends that all employees undergo at least basic cyber security training.

The same document sets out practical points that make good training content:

• Phishing and scams: attackers may use email, text, phone calls and social media, often pretending to be a trusted person or organisation. The advice is to be wary of emails, links or attachments from unknown or suspicious sources, and to contact a known sender separately if a message looks wrong.
• Passwords: use strong passwords or passphrases of at least 12 characters, avoid reuse, consider a password manager, and change default passwords on devices before they go to staff.
• Multi-factor authentication: turn it on for systems and services where possible, including cloud and email accounts.
• Backups: keep backups in a secure location not directly connected to the business network, and test them regularly.

The guide includes a case study in which an employee bought gift cards after a fake email that appeared to come from a manager. The lesson it draws is to check email addresses and verify unusual requests by another method, such as a phone call. The guide does not describe an incident reporting procedure. For suspected scams it points readers to their local Garda station or garda.ie.

The 12 Steps document: older, but specific on training

The NCSC also publishes "12 Steps to Cyber Security: Guidance on Cyber Security for Irish Business". The copy we read is marked Version 1.2, October 2018, so treat it as an older document. On staff, it recommends:

• an education and awareness programme that covers induction and recurs annually;
• bespoke training for higher-risk users, such as executives and people with privileged access;
• a clear channel for staff to report suspicious requests;
• social engineering exercises, such as phishing tests, at least annually; and
• an incident response plan that is documented and tested at least annually.

Again, these are recommendations. The document does note that personal data is regulated by the Data Protection Act 2018 and the GDPR, and that regulated entities should understand their notification obligations under the relevant regulations.

Payment fraud and business email compromise

The NCSC guidance "Protecting Against Business Email Compromise and Payment Fraud" is dated 25 July 2025. It is advisory, framed as "What you can do" steps. Its training advice includes teaching staff to spot red flags such as urgency, secrecy, external domains and unusual tone. It also recommends a strict call-back process for any change in bank details and dual approval for financial transactions above a set threshold. The page we read does not set that threshold for you.

Where NIS2 stands in Ireland

The NIS2 Directive is the EU's updated network and information security regime. According to the NCSC's NIS2 page (last updated 24 June 2025 by its own update list), the transposition deadline of 17 October 2024 was not met. The NCSC's NIS2 FAQ (last updated 3 January 2025) says the directive had not yet been transposed into Irish law and that it was not possible to give an implementation date. It also says there was no requirement to register under NIS2 at that time.

On scope, the FAQ says that typically only medium-sized and large enterprises in the covered sectors are within the directive, with some exceptions, and that the NCSC does not confirm scope for individual organisations. It points to an "Am I in Scope" tool.

Both pages are well over a year old (June 2025 and January 2025). A later European Commission press release dated 8 July 2026 says the Commission is referring Ireland to the Court of Justice of the EU because Ireland has not notified full transposition of NIS2. We have not found an official page showing the National Cyber Security Bill has been enacted; a Law Society Gazette report dated 7 October 2026 describes the Bill as still in draft. Check ncsc.gov.ie and the Oireachtas website for the latest before you rely on any of this.

Data protection is a separate legal track

Staff who handle personal data have obligations under data protection law whether or not you adopt any NCSC guide. For that side of training, read our article on GDPR staff training for employers.

A practical approach for Dublin teams

The law is national, so a Dublin office faces the same rules as any other Irish employer. The following are our suggestions, not legal requirements:

• Our suggestion: use the NCSC small business guide as a checklist, and record which items your staff have been briefed on and when.
• Our suggestion: give new starters a short briefing at induction and repeat it annually, which mirrors the 12 Steps recommendation.
• Our suggestion: run a short, honest phishing exercise and treat reports from staff as a good result, not a failure.
• Our suggestion: write down your call-back rule for bank detail changes, and make sure everyone who can approve payments knows it.
• Our suggestion: keep a simple one-page note of who to contact internally when something looks wrong.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is cyber security awareness training a legal requirement for Irish employers?

The NCSC pages we read recommend staff training as guidance and do not describe it as a legal requirement. Separate legal duties, such as data protection law, may still apply to your organisation.

Does NIS2 apply to my small business?

According to the NCSC's NIS2 FAQ, typically only medium-sized and large enterprises in the covered sectors are in scope, with some exceptions. The FAQ was last updated on 3 January 2025 and the NCSC does not confirm scope for individual organisations, so use its scope tool and take professional advice.

How often should staff be trained?

The 12 Steps document (Version 1.2, October 2018) recommends an awareness programme covering induction and recurring annually. That is a recommendation, not a legal frequency.

Where do I report a scam?

The NCSC small business guide points readers to their local Garda station or garda.ie for suspected scams. It does not set out a wider reporting procedure.

Training works best when it is regular, practical and tied to the threats your own staff see, so use the NCSC material as your baseline and check the official pages for updates.