Cyber Essentials for schools, academies and multi-academy trusts
Who asks schools, academies and multi-academy trusts for the certificate, which level to choose, what to gather first, the scope problems the sector brings and the questions it commonly fails.
- Mandated by
- No formal mandate; customer and funder requirements
- Common fails
- A6.1A7.7A7.17AUTO-FAIL
- Typical scope
- Student and classroom devices, Long-lived hardware, MIS and cloud platforms, Shared staff logins
- Cyber Essentials
- From £1,500, 1 to 2 weeks, IASME fee included
- Cyber Essentials Plus
- From £3,000, 2 to 5 weeks
The Department for Education does not require schools in England to hold Cyber Essentials. Its cyber security standards say certification is a requirement for colleges under their funding agreement and that schools may choose it. Scope covers staff devices, school-owned classroom devices and cloud platforms; student-owned devices are out of scope under v3.3.
Do schools and academy trusts need Cyber Essentials?
Not formally. No statutory requirement for schools in England. The DfE's cyber security standards cover the same technical ground and say some schools may wish to certify; colleges must under their funding agreement.
Department for Education
Source checkedIts cyber security standards for schools and colleges state that Cyber Essentials is a requirement for colleges under their funding agreement and that some schools may wish to complete it. The DfE updated them on 24 June 2026 to reflect the Cyber Essentials 2026 technical requirements (checked 3 November 2026).
Source: DfE, Meeting digital and technology standards in schools and colleges: cyber security standards
Risk Protection Arrangement (RPA)
Source checkedRPA cyber cover for public sector schools has conditions that include offline backups, NCSC cyber security training, registration with Police CyberAlarm and a cyber response plan. Cyber Essentials is not one of them (checked 3 November 2026).
Whatever the source, the contract, grant or tender is what binds you. Read it for the level it names, the scope it expects and the date the certificate must be in place, and record the reason at A1.10 when you apply.
Do schools and academy trusts need Cyber Essentials or Cyber Essentials Plus?
The DfE standards name Cyber Essentials, not Plus, for colleges. Plus is worth it for a large trust that wants independent evidence for governors, and the sample stays small when every school runs the same build.
Both levels use the same five controls and the same question set. Plus adds an independent audit of a sample of devices and cloud accounts, on the same scope as a valid Cyber Essentials certificate. Compare the two levels.
What should schools and academy trusts gather before starting?
Most of the self-assessment is describing your estate accurately. Have these to hand before you open the question set and the answers take hours, not weeks.
- A device inventory for every site, splitting staff laptops, classroom devices, servers and interactive displays by operating system version (A2.6, A2.7, A2.8).
- The operational address of every school in the trust for A1.5.1.
- A list of the platforms that hold school data: the MIS, safeguarding software, payments and parent communication apps, the learning platform and the Microsoft 365 or Google Workspace tenant (A2.9).
- Which devices are school-owned but loaned to students (in scope) and which are student-owned (out of scope).
- The VLAN or firewall design for any network you plan to exclude, since sub-sets must be created with a firewall or VLAN (A2.2.2).
What scope problems do schools and academy trusts bring?
Scope must cover every device and cloud service that reaches organisational data, or a sub-set segregated by a firewall or VLAN that you can justify. These are the boundaries this sector tends to get wrong.
Student and classroom devices
Student-owned devices are out of scope under the v3.3 third-party devices table, even on school wireless. School-owned devices, including those loaned to students, are in scope and need a supported operating system, locking, malware protection and updates.
Long-lived hardware
Interactive displays, print servers and older laptops on unsupported Windows fail A6.1 unless replaced or moved to a sub-set with no internet access.
MIS and cloud platforms
The management information system, safeguarding software and payment platforms are cloud services that cannot be excluded, and need MFA for every user where the service offers it.
Shared staff logins
Cover staff and supply teachers sharing one account fail A7.2. Give each person a named account, even a short-lived one.
Which questions do schools and academy trusts commonly fail?
Questions schools and academy trusts commonly fail include A6.1, A7.7 and A7.17AUTO-FAIL. This is a typical pattern from assessor experience, not a statistic, but it is worth planning around.
| Question | Why it fails | Fix |
|---|---|---|
| A6.1Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes? If you have included firewall or router devices in your scope, the firmware of these devices is considered to be an operating system and needs to meet this requirement. | Schools commonly carry unsupported devices, usually older Windows laptops, interactive displays and legacy servers. | Inventory every device, retire or upgrade unsupported ones, and put anything that must stay on a segregated VLAN with no internet access. |
| A7.7How does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email? | IT staff in small schools often use their admin account for email and browsing because it is the only account they have. | Create a separate standard account for daily work and keep the admin account for changes. |
| A7.17AUTO-FAILHas MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it? | MFA is often enforced for office staff but not for teaching staff on Google Workspace or Microsoft 365. | Enforce MFA for all users at tenant level through Google's 2-Step Verification enforcement or an Entra Conditional Access policy. |
Frequently asked questions
Yes, if the trust is the legal entity and the certificate scope covers each school's devices and networks. List every school site at A1.5.1. Answer A2.1 as whole organisation unless a school is deliberately excluded by a firewall or VLAN.
Student-owned devices are out of scope under v3.3, even when they join school wireless. School-owned devices are in scope whoever uses them, including laptops and iPads loaned to students. The school stays responsible for how any device interacts with its data, but student-owned ones are not assessed.
No. The DfE Cyber Security Hub lists the conditions for RPA cyber cover, including offline backups, NCSC cyber security training for staff, registration with Police CyberAlarm and a cyber response plan. Cyber Essentials helps with the technical controls but is not required for the cover.
It covers every device, network, user account and cloud service that accesses your organisation's data or services, including staff-owned phones and laptops under BYOD. You can certify part of the organisation if the excluded networks are segregated by a firewall or VLAN (A2.1, A2.2.2), but the certificate then reads 'Partial Organisation', which a buyer may question.
Twelve months from certification, and buyers under PPN 014 expect it renewed every year of the contract. Renewal is a fresh self-assessment against the question set current at the time, so a certificate first issued under an older version is reassessed against v3.3 and the Danzell question set when it renews.
Related pages
- Google Workspace setup2-Step Verification for staff accounts
- Microsoft Intune setupUpdate rings and device locking for classroom devices
- Windows 10 support statusESU rules for older classroom laptops
- iOS and iPadOS setupSupported versions and passcodes for classroom iPads
- Cyber Essentials for schools and educationThe deep page on this mandate.
- Who needs Cyber Essentials?Government, MoD, NHS and other mandates.
- Scope: what is in and outBYOD, home working, cloud and sub-sets.
- How much does it cost?Fixed prices and IASME fee bands.
- Check your readinessFree check against the 2026 question set.
- Cyber Essentials for law firms
- Cyber Essentials for accountancy and financial advisers
- Cyber Essentials for healthcare and care providers
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- GOV.UKDfE, Meeting digital and technology standards in schools and colleges: cyber security standardsRead on gov.uk (opens in a new tab)
- GOV.UKDfE Cyber Security Hub, Risk protection arrangementRead on cyber-security-hub.education.gov.uk (opens in a new tab)
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh