--- title: Board Report Checklist for Human Cyber Risk | Energy & Utilities Services | TSC description: Download the board reporting checklist for energy services and turn human cyber risk evidence into clearer, decision-ready reporting. --- [Skip to content](https://thesecuritycompany.com/energy#main-content) [![TSC Logo large](https://thesecuritycompany.com/hs-fs/hubfs/TSC%20Logo%20large.png?width=95&height=78&name=TSC%20Logo%20large.png)](https://thesecuritycompany.com/?hsLang=en) - [Human Risk Platform](https://thesecuritycompany.com/tscs-human-risk-management-platform?hsLang=en) - [Products & Services](https://thesecuritycompany.com/productsandservices?hsLang=en) - [Success Stories](https://thesecuritycompany.com/success-stories?hsLang=en) - [Resources](https://thesecuritycompany.com/our-resources?hsLang=en) - [Blog](https://thesecuritycompany.com/blog?hsLang=en) [Book a demo](https://thesecuritycompany.com/contact-us?hsLang=en) ![Search icon](https://5018647.fs1.hubspotusercontent-na1.net/hubfs/5018647/Design/Icons/Font%20Awesome/search.svg) [Book a demo](https://thesecuritycompany.com/contact-us?hsLang=en) ![ABM\_Energy](https://thesecuritycompany.com/hs-fs/hubfs/ABM_Energy.webp?width=1200&height=800&name=ABM_Energy.webp "ABM_Energy") # Make human risk visible # Move beyond completion rates and show the board the impact of your cyber security and human risk culture. Use the checklist to identify the metrics, evidence and reporting structure that show where behaviour, culture and risk stand. ![cover\_1-1](https://thesecuritycompany.com/hs-fs/hubfs/cover_1-1.webp?width=962&height=1108&name=cover_1-1.webp "cover_1-1") [![\Get the checklist\](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/27246590/interactive-487144943857.png)](https://thesecuritycompany.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJLxXTqhk9PDD24tY4jmr5QK7Yys0So3lHCiY%2BcxSt0SPP%2BSb866XgFcKzeqQKB7yOsaos9Kw20GsK%2BE4w5auRcHz1ECz2u0cfW8OA6XgVtKBjoDI8AFULmsbYWP6Aj7NvuIGwLigRr%2FhJn3W4AQHz3uNH%2FEU0BMRNxHPUsdtAB56n4xaTvQsnfhv7JvIugFbKAyCvJgtMT%2B3iXPVlOIesMQ77n%2Bon2gM6nSAfG9A6cgijLWA5myiEcRe8THYwXhAsymzxNhw30HIsLTWQ%3D&webInteractiveContentId=487144943857&portalId=27246590&hsLang=en) No form. Instant access. **Which human-risk metrics to prioritise** **Move beyond completion data** Evidence behavioural change and risk Build clearer, defensible reporting CHECKLIST PREVIEW ## Make human risk visible with evidence that drives action. ### Choose the right metric Identifying the human-risk measures that matter most to your board members, helps your report gain attention beyond training completion and participation rates. ### Make board reporting count Connect human-risk evidence to wider business risk. Use incident reporting and real outcomes to make the impact clear, credible and harder to ignore. ### Incidents and outcomes Use incidents from your sector to demonstrate how gaps in human security awareness can lead to serious operational, financial and reputational consequences. ![ABM\_Small\_cover](https://thesecuritycompany.com/hs-fs/hubfs/ABM_Small_cover.webp?width=300&height=425&name=ABM_Small_cover.webp)   ### 94% **System Intrusion, Basic Web Application Attacks and Social Engineering dominated utility breaches in Verizon’s 2026 DBIR.1** ### 68% **Of utility breaches involved compromised secrets, highlighting the value of sensitive operational and business information to attackers.²** ### 71% **Of utility breaches were associated with espionage-motivated activity in Verizon’s 2026 DBIR.³**  [**Make your cyber security culture and human risk measurable, reportable and actionable.**](https://thesecuritycompany.com/energy#sec1) *Source: 123Verizon, 2026 Data Breach Investigations Report (DBIR), Utilities (NAICS 22).* [Get the checklist](https://thesecuritycompany.com/energy#sec1) ---   ### Selected Energy & Utilities clients ![SSE\_logo](https://thesecuritycompany.com/hs-fs/hubfs/SSE_logo.webp?width=500&height=344&name=SSE_logo.webp) ![Scottish\_power\_logo](https://thesecuritycompany.com/hs-fs/hubfs/Scottish_power_logo.webp?width=500&height=344&name=Scottish_power_logo.webp) ![National\_grid\_logo-1](https://thesecuritycompany.com/hs-fs/hubfs/National_grid_logo-1.webp?width=500&height=344&name=National_grid_logo-1.webp) ![Weir\_logo](https://thesecuritycompany.com/hs-fs/hubfs/Weir_logo.webp?width=500&height=344&name=Weir_logo.webp) ![UK\_Power\_Networks](https://thesecuritycompany.com/hs-fs/hubfs/UK_Power_Networks.webp?width=500&height=344&name=UK_Power_Networks.webp) ![SGN](https://thesecuritycompany.com/hs-fs/hubfs/SGN.webp?width=500&height=344&name=SGN.webp) ![Ancanla\_logo](https://thesecuritycompany.com/hs-fs/hubfs/Ancanla_logo.webp?width=500&height=344&name=Ancanla_logo.webp) ![new-era-energy](https://thesecuritycompany.com/hs-fs/hubfs/new-era-energy.webp?width=500&height=344&name=new-era-energy.webp)   ENERGY & UTILITIES - CASE STUDY ## Experience ## Scottish Power role-based learning Scottish Power is one of the UK’s major energy companies, serving around five million households across renewable generation, electricity networks and energy supply. TSC designed and delivered a suite of interactive role-based resources for eight high-risk user groups, including senior management, HR, finance, IT, field engineers and OT teams. Each resource was tailored to the threats, responsibilities and security behaviours relevant to the role, helping employees understand how cyber security applies to their day-to-day work and how to respond confidently to risk. [![View ScottishPower case study](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/27246590/interactive-487145178339.png)](https://thesecuritycompany.com/hs/cta/wi/redirect?encryptedPayload=AVxigLIzsfaoo0gHe%2FaoRA73aWZQpSRI54uQhAxbj6QkSkgTbHUaeFX%2BhkWndYjKmkigHter7aruVyLi74rWqbJtw75ieO1rIGVjnj33vi4%2For4tczHPXBkoQxFSW%2BvdxgebaWyS8bGTMdF2VeWcIiig60vPLdjuDgUxsqeMG65%2Fxu3oLmdxNwanbXeGxNzrBiFt2FpKpWchiiwQ2pH%2BLIeFQDG%2B3Py5&webInteractiveContentId=487145178339&portalId=27246590&hsLang=en) ![Scottish\_power\_logo](https://thesecuritycompany.com/hs-fs/hubfs/Scottish_power_logo.webp?width=500&height=344&name=Scottish_power_logo.webp "Scottish_power_logo") ---     NIS & NIS2 – ADVICE SHEET ## Support Energy & utilities organisations operate essential services where cyber resilience is both an operational and regulatory requirement. In the UK, the NIS Regulations place obligations on operators of essential services, while UK-headquartered organisations with EU subsidiaries or operations may also need to consider NIS2, depending on the entity and scope criteria. TSC\_NIS\_NIS2\_2026 This guide outlines the key NIS and NIS2 principles, including governance, risk management, supply-chain security, incident reporting and staff awareness and training, helping critical organisations understand the measures needed to strengthen resilience and reduce cyber risk. [![View NIS & NIS2 advice sheet](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/27246590/interactive-487115877579.png)](https://thesecuritycompany.com/hs/cta/wi/redirect?encryptedPayload=AVxigLI4ekLejug%2BE%2Fov%2FSFj9gaxFgr5ONJKVbe74w4pk4nHGA31iVw6Y0JuLm5SCWRpBrB8gHvRDRBaR%2BpgfJhukhflCA9tssNHBqzVJEmWBk%2BG0p%2BJjxXtOnhgdhI5mHfaudDrye9apdutD4Buq4R2axUv3GklwREn88bpOcL9PGHXMJPvWj3JSpfi9IsUrpxf7TCK6sJLfKvlAuwJPduPMYpjkO2AQs843CdyAxBeMrvynJHbrQ%3D%3D&webInteractiveContentId=487115877579&portalId=27246590&hsLang=en) ![Advice\_sheet\_energy](https://thesecuritycompany.com/hs-fs/hubfs/Advice_sheet_energy.webp?width=600&height=600&name=Advice_sheet_energy.webp "Advice_sheet_energy") ---   ✖   TSC EXPERT PERSPECTIVE ## Culture ## The key cyber security asset you already have **Cyber security culture is shaped by what people do when no one is watching.** Measuring behaviours such as phishing reporting, near-miss disclosure, voluntary training engagement and simulation click rates can turn culture into a measurable part of your security strategy. By tracking these behaviours over time, organisations can identify where resilience is strengthening, where risk remains and where targeted action is needed. Watch Jason McQueen discuss security culture - 2minutes *Jason McQueen A freelance security and training management consultant with over 35 years’ experience, Jason is a serving Senior Officer in the Royal Naval Reserve. He has advised and trained military and government officials across the globe, specialising in strategic communication and countering hybrid warfare. Jason brings rare, real-world insight into how state and non-state actors exploit psychology, influence, misinformation, and behavioural vulnerabilities.* ## Make human risk visible [Get the checklist](https://thesecuritycompany.com/energy#sec1) [![TSC White Logo large](https://thesecuritycompany.com/hs-fs/hubfs/TSC%20White%20Logo%20large.webp?width=100&height=82&name=TSC%20White%20Logo%20large.webp "TSC White Logo large")](https://thesecuritycompany.com/?hsLang=en) **©** The Security Company (International) Limited 2026 Office One, 1 Coldbath Square, London, EC1R 5HL, UK Company registration No: 03703393 VAT No: 385 8337 51 [linkedin-in icon](https://uk.linkedin.com/company/thesecurityco) [Home](https://thesecuritycompany.com?hsLang=en) [Human Risk Platform](https://thesecuritycompany.com/tscs-human-risk-management-platform?hsLang=en) **[Products & Services](https://thesecuritycompany.com/productsandservices?hsLang=en)** [Contact us](https://thesecuritycompany.com/contact-us?hsLang=en) [Privacy &](https://thesecuritycompany.com/tsc-policies?hsLang=en)[Cookie Policies](https://thesecuritycompany.com/tsc-policies?hsLang=en) [Terms & Conditions](https://thesecuritycompany.com/tsc-policies?hsLang=en) **Resources** - [eBooks](https://thesecuritycompany.com/our-resources?hsLang=en) - [Reports & Whitepapers](https://thesecuritycompany.com/our-resources?hsLang=en) - [Cyber Security Calendar](https://thesecuritycompany.com/blog/security-awareness-calendar?hsLang=en) - [Webinars](https://thesecuritycompany.com/our-resources?hsLang=en) - [Blog](https://thesecuritycompany.com/blog?hsLang=en) Copyright © 2026, The Security Company Ltd ```json { "@context" : "https://schema.org", "@id" : "https://thesecuritycompany.com/#organization", "@type" : "Organization", "description" : "Cyber security awareness training and human risk management for businesses of every size.", "logo" : "https://thesecuritycompany.com/hs-fs/hubfs/TSC%20Logo%20large.png?width=190&height=156&name=TSC%20Logo%20large.png", "name" : "The Security Company", "sameAs" : [ "https://www.linkedin.com/company/thesecurityco/", "https://www.youtube.com/@thesecurityco", "https://vimeo.com/user31176192", "https://thecpdregister.com/providers/cpd-group-providers--790118", "https://ico.org.uk/ESDWebPages/Entry/Z4812822", "https://find-and-update.company-information.service.gov.uk/company/03703393", "https://registry.blockmarktech.com/certificates/19d457f5-bf79-4f85-8f6e-dd2db181ff76/", "https://www.gartner.com/reviews/product/the-security-company-security-awareness-training" ], "url" : "https://thesecuritycompany.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://thesecuritycompany.com/#website", "@type" : "WebSite", "name" : "The Security Company", "publisher" : { "@id" : "https://thesecuritycompany.com/#organization" }, "url" : "https://thesecuritycompany.com/" } ```