Cyber Safe Councils Training

Training Overview

Most cyber incidents in councils start with an ordinary action: opening a link on a phone during a shift, paying an invoice after the bank details quietly changed, or sending a spreadsheet to the wrong recipient. Suspicious emails, fraudulent payment requests, resident information and AI tools all turn up in everyday work, and the people handling them are rarely in IT.

Cyber Safe Councils is a practical, one-hour online masterclass designed specifically for local government employees. Whether you work in customer service, administration, finance, libraries, parks, or out in the field, you will learn to recognise common cyber threats, make safer decisions, and respond confidently when something doesn't look right.

Presented by Simona Dimovski, NSW Cyber Ambassador and former local government CIO and bank CISO, the course uses real-world council scenarios, interactive activities and practical tips you can apply immediately.

No technical knowledge is required. You will build the confidence and everyday habits needed to protect yourself, your colleagues and your community.

What will you gain?

By completing this course, you will learn how to:

• Recognise cyber scams: Identify suspicious emails, text messages, QR codes and phishing attempts.
• Prevent payment fraud: Spot unusual payment requests and verify changes to banking details.
• Protect your accounts: Create stronger passwords and use multi-factor authentication (MFA).
• Safeguard resident information: Handle sensitive information responsibly and avoid common data sharing mistakes.
• Use AI safely: Understand what information you should never share with public AI tools.
• Respond to cyber incidents: Know when, how and who to report suspicious activity or security mistakes to.

Who is this training for?

Cyber Safe Councils is designed for all local government employees and contractors, regardless of their role, technical knowledge or experience with technology.

Whether you work at a desk, assist residents, manage council services, or work out in the field, this course will help you recognise cyber threats and protect sensitive information in everyday situations.

The course is particularly relevant for:

• Customer service and front counter teams
• Library and community services staff
• Waste management, depot and field crews
• Rangers, parks and recreation teams
• Planning, development and compliance officers
• Finance, rates and procurement teams
• Administration, HR and records management staff
• Managers, supervisors and team leaders

No technical experience is required. The course uses plain English, practical examples from council workplaces and mobile-friendly learning activities, making it accessible to employees across all departments.

Training Modules

Four practical modules, each built around realistic council scenarios:

Module 1: The Click, Phishing and Your Password

Recognise phishing scams and protect your accounts.

• Spot suspicious emails, texts and QR codes, including scams written with AI
• Recognise the urgency, authority and fake login pages scammers rely on
• Create strong passphrases and turn on multi-factor authentication
• Verify a suspicious message safely, then report it
• Practise with an interactive Real or Fake activity

Module 2: The Payment, Fraud That Sounds Like Your Boss

Stop payment fraud before the money leaves.

• Recognise fake invoices, altered bank details and urgent payment requests
• Spot impersonation of managers, executives and trusted suppliers
• Verify any change to banking details using a number you already have
• Work through fraud scenarios from finance, customer service, rates and grants
• Practise with the interactive The Invoice That Isn't activity

Module 3: The Data and the Chatbot, Resident Information and AI

Protect resident information and use AI safely.

• Handle personal and sensitive information without accidental sharing
• Apply the need-to-know rule, and check recipients before sending
• Recognise how everyday mistakes become data breaches
• Understand what should never go into a public AI tool
• Know when to use council-approved tools, and when to ask first
• Practise with the interactive Postcard or Private activity

Module 4: The Save, Report Fast and No Blame

Know exactly what to do when something goes wrong.

• Recognise the incidents worth reporting, including your own mistakes
• Understand why reporting in minutes limits the damage
• Know who to contact and what to tell them
• Build a My Reporting Card to keep on your phone or at your desk
• Choose one habit to take back to your team

Rolling this out across your council

The Australian Signals Directorate received more than 84,700 cybercrime reports in 2024-25, about one every six minutes. Councils hold large volumes of resident data and process payments daily, and attackers target the staff handling both first.

One hour per employee, online and self-paced, with completion tracking and certificates for your records.

The Workforce Voice Report

Cyber Safe Councils does not just train your workforce; it listens to it. Short anonymous questions throughout the hour become a report for your leadership team, covering:

• Concerns: what your staff are actually worried about
• Confidence: measured before and after the course
• Exposure: the scams and suspicious activity staff have already seen
• AI usage: which tools your people are really using
• Barriers: what gets in the way of safe practice
• Commitments: the habits staff agree to adopt

Privacy by design

• Upskilled collects learner responses to deliver the training and measure outcomes
• Everything reported back to your council is de-identified and aggregated
• A minimum of 10 participants from the same council must complete the course before a report is generated
• Your council approves the report scope before training begins

Source: Australian Signals Directorate, Annual Cyber Threat Report 2024-25.

What you need to know

How is the course delivered?

100% online and self-paced, taking about an hour. No scheduled classes, no software to install and no prerequisites. It works on a computer, tablet, or phone, in one sitting or module by module.

What is included?

• Four practical modules covering phishing, payment fraud, data protection, safe AI use and incident reporting
• Six expert-led videos presented by an experienced cyber security professional
• Interactive activities including a Real or Fake phishing challenge
• A 10-question scenario quiz, 80% to pass, unlimited attempts with feedback
• Five downloadable guides covering phishing, MFA setup, payment verification, AI safety and data handling
• Certificate of completion and digital badge on finishing the course

Is this course suitable for councils outside NSW?

Yes. The examples and some legislative references come from New South Wales, but the habits apply everywhere: recognising scams, protecting information, verifying requests, using AI responsibly, and reporting quickly.

Please note: privacy obligations and data breach notification requirements differ between states and territories. Councils should apply their own requirements and internal policies alongside the course content.