Cyber Essentials for schools, trusts and education
Why schools, multi-academy trusts, colleges and universities certify Cyber Essentials, how it relates to Department for Education cyber security standards, and the scope rules for staff, student and BYOD devices.
The Department for Education's cyber security standards do not require schools to hold Cyber Essentials, but they state it is a requirement for colleges under their funding agreement and that schools may choose to certify. Under v3.3, staff and volunteer devices that access school data are in scope, while student-owned devices are out of scope.
- Who requires it
- Required for colleges under their funding agreement; optional for schools (DfE cyber security standards)
- Scheme fee
- £320 to £600 plus VAT by staff headcount (IASME, checked 2026-11-04)
- With Precursor
- Cyber Essentials from £1,500 + VAT, IASME fee included; Cyber Essentials Plus from £3,000, Cyber Essentials included
- Reviewed against
- Requirements v3.3 / CE Plus spec v3.2
Do schools need Cyber Essentials?
Schools are not required to hold it. The Department for Education's cyber security standards say Cyber Essentials is a requirement for colleges under their funding agreement, and that schools may choose to complete it.
Schools hold pupil records, safeguarding files, staff HR data and parent contact details. The DfE's cyber security standards for schools and colleges list what a cyber incident can lead to, from safeguarding issues and a significant data breach to lasting disruption and financial loss. The standards cover governance, risk assessment, training, backups and incident reporting as well as technical controls. They describe Cyber Essentials as an annual, government-backed certification that gives assurance on the technical elements, and say the standards can help a school work towards it. The DfE updated the standards on 24 June 2026 to reflect the Cyber Essentials 2026 technical requirements, so a school working to the standards is working to the current scheme.
Governors and trustees also want assurance. A certificate on the IASME register, renewed annually, is a simpler answer to "are we secure enough?" than a technical report. The standards also suggest asking an outsourced IT support provider whether it holds Cyber Essentials or Cyber Essentials Plus.
The DfE's Risk Protection Arrangement does not make Cyber Essentials a condition of its cyber cover. Its listed conditions include offline backups, NCSC cyber security training, registration with Police CyberAlarm and a cyber response plan.
Checked against the DfE cyber security standards (last updated 16 September 2026) and the DfE Cyber Security Hub on 3 November 2026.
What is in scope for a school?
Everything the school owns that accesses school data or services: staff laptops, classroom devices, servers, the MIS, the cloud tenant, the firewall and the network equipment. Question A2.6 asks for laptops, desktops and virtual desktops by operating system and quantity, and A2.8 for tablets and mobile devices. Classroom iPads and Chromebooks count.
Staff-owned devices used to access school email or the MIS are in scope as BYOD under v3.3. Volunteer-owned devices are too. Student-owned devices are out of scope even when connected to the school wireless network, because the third-party devices table puts student BYOD outside the assessment. Devices the school loans to students are in scope because the school owns them.
Wireless access points are in scope if they can communicate with other devices via the internet, and out of scope if an attacker could only reach them from within signal range.
Two recurring issues. First, unsupported operating systems on older classroom devices and on interactive whiteboards or servers running end-of-life Windows versions; these fail A6.1 unless segregated into a sub-set with no internet access. Second, shared classroom logins that fail A7.2 on unique credentials. Both are known problems with known fixes, but they take a term to work through, so start before the deadline.
How does a multi-academy trust scope it?
A trust is normally one legal entity, so one certificate covers all its schools. Question A2.1 asks whether the scope is the whole organisation or a part, and whole-organisation is the expected answer for a trust. List the school sites at A1.5.1 and describe the shared services (central tenant, MIS, finance system) so the assessor can see the estate.
Trusts that centralise IT find certification easier: one build, one patching policy, one MFA configuration. Trusts where each school runs its own IT need an inventory first, and a gap analysis is usually the right way to get it.
Should a school choose Cyber Essentials or Cyber Essentials Plus?
Cyber Essentials satisfies most expectations on schools. Plus adds an independent audit of a sample of devices and cloud services, which IASME requires within three months of the Cyber Essentials certification. It is worth considering for larger trusts and colleges, or where a funder or customer asks for it. The Plus sample can be kept small when the estate is standardised.
| At a glance | Detail |
|---|---|
| Driver | Required for colleges under their funding agreement; optional for schools under the DfE cyber security standards |
| RPA cyber cover | Not a condition; backups, NCSC training, Police CyberAlarm and a response plan are |
| In scope | School-owned devices, staff and volunteer BYOD, cloud services, network equipment |
| Out of scope | Student-owned devices |
| Trusts | One certificate per legal entity; list every site |
| Scheme fee | £320 to £600 ex VAT by headcount |
A secondary school submits with 400 staff and classroom devices listed and passes on paper, then books Cyber Essentials Plus. The authenticated patch scan finds a Windows Server 2012 print server and a classroom of laptops that missed a critical update because they were switched off over the summer. Test 2 fails on both. The retest happens after half term and passes because the school has moved the print server into a segregated VLAN and re-imaged the laptops.
How do the DfE standards map to Cyber Essentials?
The DfE cyber security standards have seven parts. Three of them line up directly with the Cyber Essentials controls; the rest go beyond the scheme.
| DfE standard | Cyber Essentials link |
|---|---|
| Secure digital technology and data with anti-malware and a firewall | Firewalls (A4) and malware protection (A8) |
| Control and secure user accounts and access privileges | User access control (A7), including MFA on cloud services |
| License digital technology and keep it up to date | Security update management (A6): supported, licensed software and updates within 14 days |
| Conduct a cyber risk assessment annually and review every term | Not assessed by Cyber Essentials |
| Create and implement a cyber awareness plan for students and staff | Not assessed; A7.12 asks how you encourage strong passwords |
| Develop and implement a plan to back up your data | Not required by Cyber Essentials; see backups |
| Report cyber attacks | Not assessed |
A school that meets the three technical standards has most of the evidence the self-assessment needs. The other four are what the Risk Protection Arrangement conditions and governors usually ask about.
What should a school prepare before starting?
- An inventory of every school-owned device by site and operating system version, including classroom iPads, Chromebooks and interactive displays (A2.6, A2.8).
- The operational address of every school in the trust (A1.5.1).
- Every cloud platform: the MIS, safeguarding, payments, parent communication and the Microsoft 365 or Google Workspace tenant (A2.9).
- The servers and their operating systems, including print and file servers (A2.7).
- Evidence that MFA is enforced for every staff account (A7.17AUTO-FAIL). The Google Workspace and Microsoft 365 setup guides show where the settings are.
How much does Cyber Essentials cost a school?
The IASME scheme fee is by headcount: £320 for 0 to 9 staff, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more, ex VAT. Precursor's Cyber Essentials is from £1,500 with the fee included and Cyber Essentials Plus from £3,000. Most schools that certify in the summer term renew before the following summer.
Next steps
Other mandates and sectors
Cyber Essentials for schools, academies and multi-academy trusts
Cyber Essentials by sector
Cyber Essentials for charities
Cyber Essentials and cyber insurance
Is Cyber Essentials worth it?
Cyber Essentials for MOD and defence suppliers
Cyber Essentials for MSPs and IT providers
Cyber Essentials for NHS suppliers and the DSPT
Cyber Essentials for UK government contracts (PPN 014)
Frequently asked questions
Not for schools. The Department for Education's cyber security standards say Cyber Essentials is a requirement for colleges under their funding agreement, and that some schools may wish to complete it as part of their cyber security activities. The standards themselves cover governance, risk assessment, training and backups as well as technical controls, and can help a school work towards certification.
No. The v3.3 third-party devices table marks student-owned BYOD as out of scope. School-owned devices loaned to students are in scope. The school remains responsible for how student devices interact with its data, but they are not assessed.
Yes if they are part of the same legal entity, which a MAT normally is. List the operational addresses at A1.5.1 and describe the scope so it is clear which schools are covered. Each school's devices and cloud services are then in scope.
School-owned devices that access school data or services are in scope, including student-facing ones. They need a supported operating system, device locking where a user is physically present, malware protection or allow-listing, and supported software patched within 14 days for critical fixes.
The cover applies to organisations with a UK or Crown Dependency head office and turnover under £20 million certifying whole-organisation scope. Whether a maintained school or academy trust qualifies depends on its legal status and turnover; check with the Certification Body when you opt in at A3.2.
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh