Confirm the route before you plan.
Planned portfolio only. Avenor’s approved scope, applicable standard version, assessor capacity, fees and service dates must be confirmed before booking. The standard’s Skills England approval is not approval of Avenor.
Checked 19 October 2026: version 1.1 is available for starts through 24 March 2027. A revised standard and assessment plan are scheduled from 25 March 2027. ST1021 is distinct from the older retired ST0124 standard.
View the official standard and assessment plan ↗What this occupation demonstrates
For apprentices who help protect systems, information and organisations. The standard has three options: Cyber Security Engineer, Cyber Risk Analyst, and Cyber Defend & Respond. Preparation should connect technical observations to proportionate decisions in the relevant option. Providers can help apprentices show how they recognise a risk, interpret evidence, act within authority and communicate what needs attention. Safe practice is essential: a learning exercise should never become unauthorised testing of a live system or an unnecessary disclosure of sensitive security information.
Providers supporting security engineering, cyber risk or operational defence and response roles across public and private organisations.
- Explain a security issue in its business and technical context.
- Distinguish evidence from assumptions when analysing a risk or alert.
- Recommend and communicate proportionate action within authorised boundaries.
Prepare for a fair assessment
Use the applicable plan as your starting point. The following are preparation prompts, rather than additional gateway requirements or a substitute for the assessment specification.
- Confirm the option at the start of planning. Risk analysis, security engineering and operational response need different workplace examples even where they share core principles.
- Use sanitised records or a dedicated lab for practice. Never include live credentials, exploitable configuration details or confidential incident information in a general learning resource.
- Practise explaining both a false alarm and a genuine concern. Ask how the apprentice reached the decision, what additional evidence was needed and who was authorised to accept the remaining risk.
Plan a useful handover.
Buy against the registered Cyber Security Engineer, Cyber Risk Analyst, or Cyber Defend & Respond option and the employer's safe evidence boundaries. Share volumes and broad operating contexts without disclosing vulnerabilities. Ask how occupational currency is maintained, how practical activity is isolated, how conflicts and confidentiality are managed, and what happens when incident material cannot be exported. The provider owns option and version accuracy; the employer security owner authorises practice and release; a separate assessment coordinator protects scheduling information from becoming operational access.
A realistic evidence conversation
Illustrative, not a prescribed requirement: a defend-and-respond apprentice investigates an alert in a controlled exercise. The record shows initial evidence, competing hypotheses, authorised queries, a false-positive check, escalation threshold, containment recommendation and business impact. Indicators are synthetic and no live topology or credentials are included. Use this to ask a prospective organisation how it preserves authenticity without collecting dangerous detail, distinguishes the three options and ensures an assessor never asks the apprentice to exceed authority or reveal active weaknesses.
Handover checks
- Programme owner confirms ST1021, the option and version rather than relying on retired ST0124 material.
- Employer security owner approves lab boundaries, sanitisation and the named evidence-transfer route.
- Assessment coordinator separates access logistics from operational credentials and incident permissions.
Questions to ask before buying
- Which ST1021 options are within your verified scope, and how do assessor competences match them?
- How will you review authentic cyber evidence without requesting exploitable information?
- What safeguards apply to remote practical activity, assessor access and incident escalation?
Think it through.
Explain your decisions.
These are original learning prompts. They are not live assessment questions, an official mock paper or a prediction of your result.
1. An alert shows an unusual sign-in. What would you do before declaring an incident?
Explore a response structure
Consider the user context, device, location, timing and corroborating logs. Describe how you would preserve relevant information and follow escalation procedures. Explain what would increase or reduce your confidence and avoid treating a single indicator as a complete conclusion.
2. A vulnerability has a high technical severity but affects a restricted system. How would you prioritise action?
Explore a response structure
Consider exposure, exploitability, affected information, business impact and existing controls. Explain how you would document uncertainty and involve the risk owner. Do not assume a numeric score alone determines an organisation’s response.
3. How would you communicate a security concern to a non-technical manager?
Explore a response structure
Describe the affected business activity, plausible consequence and recommended decision in plain language. Separate confirmed facts from possibilities. State the urgency, owner and next check without exaggerating the evidence or hiding material uncertainty.
Questions about this standard
Can practice involve real penetration testing?
Only use systems and activity explicitly authorised by the responsible organisation and appropriate to the apprentice’s role. A safe lab can support learning without exposing a production service or exceeding the agreed testing scope.
Which assessment methods apply?
Use the published assessment plan for the apprentice’s registered version and option. Methods, timings, gateway documents and grading rules can differ between versions. These original practice prompts are learning resources, not live assessment questions or a prediction of an assessment outcome.
Can we book with Avenor?
This standard is in Avenor’s planned portfolio. Ask us to confirm our approved scope, the applicable version, assessor capacity, fees and dates before making a booking. Publication of this guide does not establish Avenor approval.
Sources and review
Guide updated 20 October 2026; official source reviewed 20 October 2026. Standard titles, versions and requirements can change. Always check the linked official record for the apprentice’s start date.
Skills England: Cyber Security Technologist (2021) ↗450 starts in 2023/24, published in the ICT-related apprenticeship data. Historic starts inform our portfolio; they do not establish today’s demand or our availability.