Cyber Essentials for Schools

Why schools and academy trusts get certified

Schools and trusts hold some of the most sensitive personal data there is, about children, and increasingly have to prove they protect it. The Department for Education's digital and technology standards point at Cyber Essentials as the baseline, and trusts, local authorities and suppliers are writing it into their requirements.

• The DfE cyber standards expect it. The Department for Education's cyber security standards for schools point squarely at Cyber Essentials, and governors, trusts and local authorities increasingly ask to see it.
• Trust and local-authority procurement. Multi-academy trusts and local authorities increasingly require Cyber Essentials from the schools and suppliers they share systems and data with.
• Safeguarding and pupil data. A breach involving children's data is a safeguarding and reputational problem, not just an IT one; certification evidences the basics are locked down.
• Ransomware and insurance. Education has been a heavy ransomware target, and insurers increasingly want Cyber Essentials before they will cover a school or trust.

The security benefit is real and worth having. But the honest reason most schools and academy trusts certify is commercial: work, funding or clients increasingly depend on it.

Prepared properly, passed first time

We scope it with you, tell you plainly what needs to change, and prepare a clean submission so you pass first time rather than paying to resubmit. You are guided by a certified IASME assessor for both Cyber Essentials and Cyber Assurance, someone who knows exactly what the assessment checks, not an account manager and not a junior with a checklist.

Cyber Essentials and Cyber Essentials Plus

Cyber Essentials is a verified self-assessment against five technical controls, certified annually. Cyber Essentials Plus covers the same five controls but adds an independent, hands-on technical audit of your systems: the level a growing number of buyers now specify. We will tell you which one your buyers actually require, rather than pushing the higher tier by default.

What it covers

Five controls that block the great majority of commodity attacks: firewalls, secure configuration, security update management, user access control, and malware protection. Straightforward for most organisations, provided someone tells you honestly what needs changing before you submit.

How it works

Certification is largely remote, so it adds no travel to your invoice. We agree the scope with you, we help you get the controls in order and support you through the assessment on the IASME portal. Where Cyber Essentials Plus applies, the technical audit is scheduled around you. Turnaround is days rather than weeks when your controls are already in order.

Where it fits

For most schools and academy trusts Cyber Essentials is the right first step. Where clients or funders want evidence of more than the baseline, Cyber Assurance is the next rung and stands in for ISO 27001 at SME cost. If you hold anything genuinely sensitive, test it with a proper penetration test.

Common questions