Cyber Essentials for schools, colleges and multi-academy trusts
Pupil records, safeguarding files and staff data, often looked after by a small IT team covering every other job in the building. Cyber Essentials gives you a clear, achievable baseline, and we explain each requirement without the jargon.
At a glance
- Plain-English guidance for busy school IT teams
- Help scoping parent apps, MIS and cloud safeguarding tools
- Supported or Marking Only: you choose the level of help
Why schools and colleges certify
Expected by the people you answer to
Trusts, local authorities, insurers and partners increasingly ask for evidence of a recognised security baseline. A current certificate answers that question clearly.
Education is a regular target
Schools and colleges are frequent targets of phishing and ransomware. The five Cyber Essentials controls are designed to stop the most common internet-based attacks.
A reason to tidy up
Certification gives you a structured reason to review the devices, accounts and software that have built up over years of term-time fixes.
Where education applicants commonly trip up
These are the issues we see most often when marking assessments, so you can deal with them before you submit.
- Scoping only the obvious cloud services. It’s rarely just your MIS and Microsoft 365 or Google Workspace. Parent communication apps, cashless catering, online learning platforms and cloud safeguarding software all hold school data, so they’re in scope.
- MFA gaps on cloud accounts. Under the current v3.3 requirements, any cloud service that offers multi-factor authentication must have it turned on for every user. A missing setting is an automatic fail.
- Staff using personal devices. Phones and laptops used to check school email or admin systems are in scope and need to meet the same controls, or be managed under a clear BYOD approach.
- Legacy machines in specialist rooms. Design technology, music and science suites often run older, unsupported software. These need updating, replacing or separating from your scope before you submit.
Two ways to get certified
Our Supported Service gives your IT lead a plain-English gap analysis before anything goes near the official portal, so nothing catches you out on submission day. If your setup is already in good shape, Marking Only gets you certified quickly and cost-effectively.
For confident, well-prepared teams
Ideal if you have in-house expertise and have already checked your setup against the requirements.
- Your own secure assessment portal
- Independent marking with a feedback report
- Two working days to fix any non-compliances, then a complimentary re-mark
- Cyber Essentials report and certificate included
Cyber liability insurance is subject to IASME’s terms. Certifying more than one organisation? Define each additional organisation within your assessment and you’ll automatically be asked whether you’d like a duplicate certificate.
Buy Marking OnlyA senior assessor with you all the way
The right choice for most organisations, and for anyone working to a deadline.
- Your own assigned senior assessor
- Readiness check and gap analysis before anything is submitted
- Feedback within 24 working hours, with same-day assessments available subject to T&C’s
- Unlimited remote support for every question
- As many attempts as you need within the six-month assessment window
- Cyber Essentials report and certificate included
For our Supported Service: 100% of applicants who have followed our advice and who have submitted within the required deadlines have passed. Cyber liability insurance is subject to IASME’s terms. Certifying more than one organisation? Define each additional organisation within your assessment and you’ll automatically be asked whether you’d like a duplicate certificate.
Buy SupportedPrices are “from” prices, exclude VAT and depend on organisation size; your exact price is shown in our shop. Free cyber liability insurance is available to eligible organisations (IASME terms apply).
Guidance for schools and colleges
Practical articles from our assessors in the Resource Hub.
“Excellent support from Mark across multiple schools. Mark has been incredibly supportive throughout our Cyber Essentials assessments.”
Mr RSG, schools group · Google reviewCommon questions
Does Cyber Essentials cover our MIS provider?
Your certification covers the devices, accounts and services under your organisation’s control, including how you access and configure cloud services such as your MIS. The provider’s own infrastructure is their responsibility, so check their security as part of your due diligence.
Can a multi-academy trust certify once for all its schools?
It depends on how centrally your IT is managed. Where schools share the same managed network and policies a single scope can work; where they don’t, separate certificates may be clearer. We’ll talk through the right scope with you before you start.
How long does it take?
That depends mostly on how much needs fixing. With the Supported Service we return feedback within 24 working hours, and you have up to six months from starting your assessment to complete it.
More answers in our full FAQs.
Talk to an assessor who understands schools
Book a free scoping call and we’ll help you work out what’s in scope before you commit.