This element equips learners with essential knowledge and practical skills to identify, assess and mitigate online risks, including malware, phishing, iden
Topic Synopsis
This element equips learners with essential knowledge and practical skills to identify, assess and mitigate online risks, including malware, phishing, identity theft and cyberbullying. It emphasises proactive safeguarding measures, secure data handling practices and compliance with relevant legislation such as the Computer Misuse Act and UK GDPR, ensuring IT users can operate safely and legally in digital environments.
Key Concepts & Core Principles
- Productivity tools: Mastery of word processing, spreadsheets, presentation software, and databases to create, edit, and manage documents efficiently.
- File management: Understanding how to organise, save, and retrieve files using appropriate naming conventions and folder structures.
- Data security: Awareness of risks like viruses, phishing, and data loss, and how to protect information using passwords, backups, and antivirus software.
- Legal and ethical use: Knowledge of copyright, data protection (GDPR), and acceptable use policies when using IT systems.
- Improving productivity: Techniques to streamline tasks, such as using templates, shortcuts, and automation features in software.
Exam Tips & Revision Strategies
- When answering scenario-based questions, always reference specific legislation by name (e.g., Computer Misuse Act) and explain how it applies to the situation described.
- Use concrete, practical examples to illustrate safeguarding techniques, such as describing how to spot a phishing email or setting up two-factor authentication.
- Demonstrate a clear understanding of the difference between technical safeguards (firewalls, encryption) and behavioural safeguards (not sharing passwords, logging off shared machines).
- If the assessment requires you to produce documentation, ensure it reflects real-world practice: include step-by-step procedures and reference relevant laws and organisational policies.
Common Misconceptions & Mistakes to Avoid
- Confusing the different types of malware (e.g., virus vs worm vs trojan) and their infection methods.
- Overlooking physical security risks, such as shoulder surfing or leaving devices unlocked in public spaces.
- Assuming that anti-virus software alone provides complete protection without the need for regular updates or user vigilance.
- Failing to distinguish between organisational policies and legal requirements, leading to incomplete compliance evidence.
Examiner Marking Points
- Award credit for demonstrating the ability to correctly identify and classify common internet threats, such as phishing emails, ransomware and social engineering attacks.
- Award credit for evidencing the application of robust data security measures, including encryption, secure password protocols and regular backup procedures.
- Award credit for accurately explaining the key principles of UK GDPR, Computer Misuse Act and organisational acceptable use policies, and how they apply to an IT user’s daily activities.
- Award credit for producing clear guidance or practical examples on safeguarding personal and company data, such as recognising secure websites (HTTPS) and using VPNs on public Wi-Fi.