• Vocational Certification

CSFT

Cyber Scheme Foundations: Technical

practical technical and security-testing capability

Build practical technical cyber skills and demonstrate professional competence.

Why technical cyber foundations matter

Cyber security teams need people who can understand how systems work, use technical tools safely and explain what they find. At foundation level, that means more than learning terminology: it means becoming comfortable with operating systems, command-line work, scripting, networks, traffic, web technologies and vulnerability assessment.

Cyber Scheme Foundations: Technical provides a structured route into this work. It helps learners connect individual technologies and techniques to authorised, scoped security testing and to the professional standards expected in the cyber security industry.

Why choose Cyber Scheme Foundations: Technical?

CSFT is the technical pathway within the Cyber Scheme Foundations portfolio. It combines expert-led teaching with practical activity across the systems, tools and concepts used by junior technical practitioners.

The course also places technical work in context. Learners consider the legal and ethical boundaries of security testing, how to stay within scope, how to maintain an appropriate testing device and how to use tools and evidence responsibly.

For people who want to build cyber risk, governance and communication capability rather than hands-on technical capability, Cyber Scheme Foundations: Risk provides the parallel CSFR pathway.

What you will learn

The course covers:

  • The laws, ethics, scope and risks associated with security testing.
  • Building and maintaining a security-testing device.
  • Linux command-line skills for security testing.
  • Linux scripting using Bash.
  • Python fundamentals for ethical-hacking tasks.
  • Windows command-line, user, policy, remote-access and networking fundamentals.
  • Computer networking fundamentals, including DNS, ARP, subnetting concepts, OSI and TCP/IP.
  • Packet capture, filtering, TCP streams and traffic analysis.
  • Web application fundamentals, including HTTP, sessions, scripts, headers and response codes.
  • Vulnerability analysis, credentialed testing, CIS benchmarks, CVSS and port scanning.
  • Mobile-device testing fundamentals.
  • An introduction to cloud security testing in Azure and AWS.

 

Practical learning

Learners are immersed in technical cyber security through hands-on exercises and expert tuition. The course is designed to identify and address knowledge gaps while helping participants build confidence with the systems, commands, scripts and tools used in junior technical practice.

Training is currently delivered remotely, allowing participants to join from anywhere in the world. Learners use their own prepared device and virtual security-testing environment throughout the course.

Professional development

CSFT supports a structured start in the cyber security profession. The qualification content has been aligned with the competencies for the UK Cyber Security Council’s Associate Cyber Security Professional title. 

Who should attend?

  • Graduates, apprentices and people at an early stage of a technical cyber career.
  • Career changers and service leavers seeking a structured route into technical cyber security.
  • Junior security testers and early-career technical practitioners.
  • IT and support professionals moving towards security-focused roles.
  • Employers developing foundation-level technical capability within their teams.

 

Preparing for the course

There are no formal course prerequisites. Participants do, however, need a suitable working laptop and should complete the technical setup before the course.

Device and environment

  • A supported Windows device is recommended; other operating systems may be used where the participant can provide their own IT support.
  • Administrative rights to install and remove required software.
  • A virtualisation solution such as Oracle VirtualBox.
  • A working Kali Linux virtual machine.
  • Vulnerability-assessment software such as Nessus or a supported alternative.
  • At least 8 GB of RAM and 200 GB of available disk space for the recommended virtual-machine setup.
  • A working power supply, wired Ethernet capability and usable USB ports.
  • WireGuard VPN installed, with the required administrative access.

 

Assessment

The assessment combines practical skills with a demonstration of knowledge and understanding, delivered through a presentation and a technical interview. It is open book, but candidates must demonstrate their own technical ability rather than rely solely on reference materials.

The approach is sample-based and designed to evaluate competence without creating an unnecessarily long or arduous process. Presentation and resource preparation is currently stated as 60 minutes; publish the complete confirmed format in the joining instructions and assessment guidance.

Fast-Track your application for an Associate Cyber Security Professional Title

The Cyber Scheme are proud to share that our CSFL Certification has been fully aligned with the UK Cyber Security Council’s Associate Cyber Security Professional title.

This means that anyone who holds this qualification has already demonstrated that they meet ALL the required competencies for the title and can fast-track their Associate application with ourselves or with the UK Cyber Security Council, without needing to provide that evidence again.

The Associate Title is intended to address a common barrier to entering the sector: candidates often need experience to secure a first role, but need a first role to gain that experience. The practical nature of our CSFL course and related assessment assures employers that you have the skills they are looking for.

Book your CSFT training and assessment
View the joining instructions here

Remote Training

Available anywhere worldwide with our remote learning course.

The Cyber Scheme’s comprehensive two and a half day training course will highlight and enhance the skills and knowledge required in order to be successful in the assessment, which takes place on the afternoon of the final day. 

As soon as candidates begin the course they will be immersed in the world of cyber security with practical hands-on exercises and expert tuition from a Cyber Scheme Instructor. They will learn about Linux systems, Windows systems, how to script in bash and in python. Also taught are the fundamentals of computer networking, web application technologies and vulnerability scanning, as well as the laws and ethics associated with security testing. This training will give candidates the essential skills of an ethical hacker at junior level.

Training Modules

See below the topics which will be covered. There will be ample opportunities to identify and address specific knowledge gaps directly with our trainers whilst undertaking training.

  • Understands and can apply the Computer Misuse Act to stay within a scope
  • Has knowledge of how the PJA / RIPA laws affect security testing
  • Is aware of how the GDPR and the DPA affects security testing
  • Understands how the HRA has to be applied as part of a security test
  • Has an understanding of ACPO (Formerly known as) and where it applies
  • Understands what should be in a scope and keeping to scope
  • Understands the risks associated with any form of security testing. 
  • Can recommend and implement full disk encryption
  • Understands the fundamentals of using virtualised and non-virtualised distros for security testing
  • Can demonstrate how to install and maintain a security testing distro 
  • Can justify the use of administrative and non-administrative accounts for security testing 
  • Can customise a security testing distro to complete an engagement based on a scoping document.
  • Understands the folder structure and standards used on device with a Linux operating system 
  • Can demonstrate how to list a range of files and can explain the displayed output 
  • Can demonstrate how to manipulate a range of files using a range of applications 
  • Understands how to copy, move and delete files on a Linux file system 
  • Can manipulate and navigate the directory structure of a Linux File system 
  • Can demonstrate setting up file permissions and can justify the choices made 
  • Understands the use of escalation techniques to prevent overuse of the superuser in a Linux environment 
  • Can demonstrate the use of search tools, filters and pipes 
  • Can competently make use of foreground and background processes 
  • Can demonstrate the use of the tools available in a Linux environment to trouble shoot networking issues 
  • Understands a range of administrative protocols used to administer a Linux system 
  • Understands the use remote file systems both for enumeration and configuration purposes 
  • Can demonstrate how to administer user accounts and understand the fundamental technologies in use 
  • Understands the file compression techniques available in a Linux environment
  • Can use local resources for tool and utility advice and guidance 
  • Can demonstrate the configuration and enumeration of timed events to administer a Linux system.
  • Understands the fundamentals of Linux scripting 
  • Understands the importance of iteration in program code and scripting 
  • Can justify the use of Functions and Returns for structured code practices
  • Can read and evaluate scripts
  • Can reuse and modify scripts
  • Can use AI to vibe code for hacking purposes.
  • Understands the layout, principles, and construction of python code
  • Can construct iteration code to apply secure coding principles 
  • Can use functions to apply the “DRY” coding principle
  • Understands the fundamentals of Python code
  • Can read and evaluate Python code
  • Can reuse and modify Python code
  • Can use AI to vibe code for hacking purposes.
  • Understands how to manipulate files and folders including hidden files in a Windows environment    
  • Can demonstrate how to traverse and manipulate the directory structure 
  • Understands how to enumerate and manipulate a Windows system for users, shares and policies using the command line interface (CLI)  
  • Understands the difference between the domain controller (DC), workstations and non-domain joined devices 
  • Understands how to read and write to the file system using various techniques
  • Understands user privileges and the security models available in Windows environments
  • Can demonstrate the use of network trouble shooting tools and utilities to solve commonly found issues 
  • Can demonstrate basic PowerShell commands and understands the security model in place 
  • Understands the fundamental principles of the remote desktop protocol, virtual network computing and secure shell in a Windows Environment 
  • Understands the networking configuration and how to enumerate it in a Windows operating system
  • Understands the concept of password hashing, brute forcing and using MFA. 
  • Understands the use of DNS, and the DNS record types
  • Understands the ARP protocol and its uses
  • Understands the use of gateway devices to divide subnets
  • Understands the 7 layer OSI model and the 4 layer DoD model
  • Has a fundamental grip on the TCP/IP suite of protocols including UDP
  • Understands a range of management protocols on a computer network. 
  • Can demonstrate the configuration of packet capturing software 
  • Can capture and analyse the various network packets on a TCP network 
  • Understands how to apply filters to packet capturing tools 
  • Can demonstrate the capturing of TCP streams and interpret the data. 
  • Understands the send and receive HTTP model
  • Understands the concept of session tokens to identify user sessions
  • Can demonstrate how to run scripts embedded in HTML pages. 
  • Understands security headers and can recommend improvements based on a scenario
  • Understands the response and error codes associated with the HTTP(s) protocol. 
  • Can demonstrate the installation and configuration of VA software and tools 
  • Can demonstrate the configuration of a scan to achieve a set goal 
  • Can check for false positives and understands the VA tool output
  • Understands how to configure VA software to complete a credentialed security test
  • Understands how to configure VA software to complete a CIS benchmark security test
  • Understands the basics of using The Common Vulnerability Scoring System (CVSS)
  • Understands the basics of port scanning.
  • Understands the function of mobile device management (MDM)
  • Can determine if a device is jailbroken
  • Can check and recommend patching and software levels
  • Understands mobile technical controls
  • Understands the file types associated with mobile applications.
  • Understands the basics of Cloud security testing.
  • Understands the basics principles of testing within Azure
  • Understands the basics principles of testing within AWS.
Download the CSFT syllabus
Preparing for the training course

Joining instructions including timings will be provided when you book. They are also available at the link above; please study them prior to attending. You should bring a working laptop, with a virtualised working copy of Kali Linux and a working copy of Nessus. (Other options / configurations are available.)

Before your course begins

Please look at these videos created by our Head Of Education Paul Richards, for in-depth instruction on how to set up Linux (essential for attendance on the training course).

The Assessment
The assessment will combine practical skills with a demonstration of knowledge and understanding, delivered through a presentation and a technical interview. It will be open book; however, candidates will need to showcase their technical ability rather than rely solely on resources. The assessment will not be a long or arduous process and will adopt a more sample-based approach to evaluating candidates.
 
Presentation and resource preparation 60 minutes
Technical Showcase 15 minutes
Interview 15 minutes
Multiple Choice 30 minutes

Passes for successful candidates will be awarded at Pass, Merit or Distinction. Credits and discounts will be available to successful candidates looking to progress to our other certifications.

Preparing for the assessment

Joining instructions including timings will be provided when you book. They are also available at the link below; please study them prior to attending.

You must supply your own laptop, with a security testing distro, Nessus (or some form of VA software) and a working powers supply, wired ethernet port and have admin rights to add and remove software as required. You will need to use the USB ports to copy data.

Please be fully prepared and ready before your given start time; allow 30 minutes to get set up.

We do not currently ask for hard drives to be wiped during this assessment, but all relevant data must be removed from your laptop at the end of the assessment.

Access Joining Instructions
The Cyber Scheme is now an Approved ELCAS Provider

ELCAS provides financial support to eligible armed forces members for higher-level learning, offering up to £2,000 annually over three claim years.

All of our assessments, including our CSFL Foundation Level and our flagship Technical Assessment, Cyber Scheme Team Member (CSTM), as well as our training programmes from entry to advanced level are now fully ELCAS-eligible. These certifications provide pathways to high-demand cyber careers and meet strict government standards for assurance schemes including CHECK and Cyber Essentials.

Provider ID: 13341. Please click here for more details.

Inclusivity and Accessibility

The Cyber Scheme believe everyone should have access to a career in cyber security. We are available to discuss any concerns you have and are more than happy to make reasonable adjustments for any candidate who requires them during examinations. 

These reasonable adjustments are to ensure you are given an equal opportunity to demonstrate the necessary knowledge, skills and behaviours required. We recognise that not all disabilities are visible.

We have a range of reasonable adjustments we can offer depending on what difficulty you might face. If you request an adjustment which we are unable to offer, we will give you a reason why we cannot offer it. This might be because it maps to a key Knowledge, Skill or Behaviour that we have to assess against within the certification.  If that is the case, we will tell you which aspect we think would not be properly assessed.