Cyber Security for Schools & Trusts

Education is targeted relentlessly, holds highly sensitive data about children, and is expected to meet standards on budgets that make commercial security provision impossible.

Talk to an Expert → See Pricing
Primary risk
Ransomware and data theft
Drivers
DfE digital standards, ESFA
Data held
Safeguarding, SEN, staff
Priced for
Education budgets

Why education gets hit

Schools combine valuable data with constrained resources, large user populations who are not security-trained, and a mix of managed and unmanaged devices. Ransomware operators know a school cannot function offline and that the pressure to restore is enormous.

The data is the serious part. Safeguarding records, SEN information, free school meals eligibility, medical needs, family circumstances. This is among the most sensitive personal data any organisation holds, and it concerns children.

What we consistently find

  • MIS access far broader than necessary — staff able to see safeguarding records with no operational need.
  • Shared accounts in offices, libraries and technician roles, making attribution impossible.
  • Flat networks where a compromised student device reaches the finance system.
  • Remote access to servers opened during the pandemic and never closed.
  • Third-party apps adopted by individual teachers, holding pupil data, with no due diligence and often no contract.
  • Backups on the same network as everything else, encrypted alongside it.

Standards and expectations

The Department for Education publishes digital and technology standards for schools and colleges covering cyber security, and these have moved from advisory toward expected. Trusts face ESFA scrutiny of risk management. Governors are increasingly asked to evidence oversight. Cyber Essentials is frequently the mechanism used to demonstrate it.

Standards do move — check the current DfE position rather than relying on what was true last year.

How we work with education

Engagements are sized to education budgets, not commercial ones, and we will tell you plainly when free NCSC guidance covers what you need rather than charging for the same advice. Findings are written so a business manager or headteacher can act on them and take them to governors — not so they impress another security consultant.

For most schools the sensible order is: Cyber Essentials, an external infrastructure test, an MIS access review, and a genuine backup restore test. That last one is free and is the thing most likely to save you.

Common questions

We have almost no budget. Is anything worth doing?

Yes, and much of it costs nothing. MFA on all staff email and remote access. Reviewing who can see safeguarding data in your MIS. Actually testing that a backup restores. Those three cost time rather than money and address most of what we see go wrong.

Does the DfE require Cyber Essentials?

The DfE's digital and technology standards cover cyber security and reference certification. Expectations have tightened and continue to move, so check the current position directly — but in practice most trusts are working toward it, and governors increasingly ask for it.

Will testing disrupt teaching?

No. External testing is invisible to users. Internal testing is scheduled around the school day, and we routinely work in holidays or after hours. We agree rules of engagement in advance and stay contactable throughout.

We're a multi-academy trust with different systems per school. How does that scope?

This is common and genuinely affects scoping. Usually we test a representative sample plus any shared central infrastructure, then help you build a rolling programme rather than testing everything at once. We'll be honest about what a given budget can realistically cover.

What about student data protection specifically?

Access control is the practical answer. Most schools have far too many staff able to see far too much. An MIS permissions review is often the highest-value hour we spend with a school, and it costs nothing to act on.

Related

Cyber EssentialsThe certification governors and the DfE expect. Incident ResponseRansomware planning before it happens. Infrastructure TestingNetwork segmentation and remote access.

Ready to talk?

Scoping conversations are free and there is no sales team to get past. Tell us what you're dealing with and we'll tell you honestly what you need.

Talk to an Expert → See Pricing