CYBER ESSENTIALS FOR
SCHOOLS & MATs
In today's digital classroom, your network is the backbone of learning. From safeguarding sensitive student records to managing the complex IT estates of Multi-Academy Trusts, schools are a high-value target for cyber attacks. We make Cyber Essentials simple — practical security that meets DfE requirements without disrupting the school day.
WHY CYBER ESSENTIALS MATTERS FOR YOUR SECTOR
MEET DfE & ESFA REQUIREMENTS
The Department for Education recommends Cyber Essentials. Achieving certification demonstrates you meet the technical measures required for government funding and data protection compliance.
SAFEGUARD STUDENT & STAFF DATA
Protect the personal details of students and staff. Certification demonstrates a security-first approach to safeguarding — a GDPR requirement and a moral responsibility.
UNLOCK LOWER INSURANCE PREMIUMS
Cyber insurance is becoming harder for schools to secure. Cyber Essentials is often a mandatory prerequisite for coverage and can significantly reduce your annual premiums.
MANAGE MAT COMPLEXITY
Managing security across multiple sites can be challenging. We provide a clear roadmap to bring every school in your trust up to the same standard, simplifying central oversight.
GOOGLE WORKSPACE & MICROSOFT 365
Cloud platforms are secure by design — but not automatically secure in use. We check that your MFA, admin access, and configurations are actually protecting you under the Danzell requirements.
PROTECT AGAINST 80% OF ATTACKS
Most school breaches are automated commodity attacks — phishing and basic malware. Cyber Essentials secures the five core controls that stop the vast majority of these threats.
WHAT CYBER ESSENTIALS COVERS
Endorsed by the National Cyber Security Centre (NCSC), Cyber Essentials is a UK government-backed certification that requires schools to secure their devices, control access, and guard against malware. Certification is built around five technical controls, each independently verified by an approved assessor.
Control 1
FIREWALLS
Secure your internet connection with boundary firewalls and internet gateways that prevent unauthorised access to your school network.
Control 2
SECURE CONFIGURATION
Ensure all devices and software are configured securely — removing default credentials, unnecessary applications, and functions that create exploitable risk on school devices.
Control 3
SECURITY UPDATE MANAGEMENT
Keep all devices and software updated to the latest versions. Unpatched systems are the primary entry point for the ransomware attacks that increasingly target schools.
Control 4
ACCESS CONTROL
Restrict administrative privileges and enforce strong user authentication — ensuring only authorised staff can access sensitive student and financial records.
Control 5
MALWARE PROTECTION
Antivirus software and application controls to block malicious software from compromising school devices and the sensitive data they hold.
THE CERTIFICATION PROCESS
SELF-ASSESSMENT
Your IT team answers technical questions about your network, devices, and cloud services via a secure online portal.
SENIOR SIGN-OFF
A senior responsible officer — typically a headteacher, principal, or trust CEO — must sign off the assessment before submission.
ASSESSOR REVIEW
A qualified IASME assessor marks your submission and verifies your responses against the five controls before issuing your certificate.
ANNUAL RENEWAL
Certificates are valid for 12 months. Annual renewal maintains your baseline protection against evolving threats and satisfies DfE and funding requirements.
Tier 1
CYBER ESSENTIALS
A verified self-assessment questionnaire signed off by a senior officer and reviewed by a qualified assessor. Sufficient for DfE compliance, government funding requirements, and the majority of procurement and insurance needs.
- ✓Self-assessment questionnaire
- ✓Senior officer sign-off
- ✓IASME assessor verification
- ✓Free £25k cyber insurance (eligible orgs)
Tier 2
CYBER ESSENTIALS PLUS
For institutions requiring a higher level of assurance. Adds a hands-on technical audit where a qualified assessor actively tests your devices and systems to verify the five controls are working correctly in your specific school environment.
- ✓Everything in Cyber Essentials
- ✓Independent hands-on technical audit
- ✓Live device testing in your school environment
- ✓Higher assurance for trust-wide or multi-site requirements
HOW WE WORK WITH YOU
We guide you through every step of the Cyber Essentials process — from initial scoping through to your certificate. Our approach is built around your sector's specific requirements, working around your operational constraints.
What's Included
- Initial scoping call to understand your environment
- Guided submission support against Cyber Essentials requirements
- Guidance on addressing any gaps identified
- Support through the self-assessment questionnaire
- IASME assessor review and certification
- Certificate, digital badge, and NCSC register listing
COMMON QUESTIONS
READY TO CERTIFY YOUR SCHOOL OR MAT?
Talk to our UK-based team. We make Cyber Essentials straightforward for the education sector — no jargon, no disruption.