The short answer
Cyber Essentials for schools is optional in law, but colleges must hold it under their funding agreement. It is the government-backed check on the technical side of cyber security for schools and trusts, and covers much of the DfE cyber security standards that schools should be working towards by 2030. Certification with Sovereign Secure starts at £320 + VAT, priced by staff numbers.
On this page
- Do schools need Cyber Essentials?
- What do the DfE cyber security standards require?
- Are student devices in Cyber Essentials scope?
- How do academy trusts get Cyber Essentials?
- What if a shared IT provider or local authority runs your IT?
- Free cyber security for schools: where to get training and help
- How much does Cyber Essentials for schools cost?
- Why Sovereign Secure
- Get started
Cyber Essentials for schools is optional in law but closely tied to what the DfE expects. Schools in England have no legal duty to certify, colleges must hold Cyber Essentials under their funding agreement, and the Department for Education (DfE) says some schools may wish to complete it as part of their cyber security work. Cyber security is one of six core standards that all schools and colleges should be working towards by 2030, and Cyber Essentials is the independent check on its technical side: firewalls, secure configuration, security updates, user access control and malware protection.
This page covers what is specific to schools and trusts; for the scheme itself, see our Cyber Essentials certification page.
Do schools need Cyber Essentials?
Not as a legal requirement, but several rules point schools towards it:
- Further education (FE) colleges must hold Cyber Essentials under their funding agreement, so this page covers Cyber Essentials for education providers of every kind, from primary schools to FE colleges.
- All schools and colleges have a statutory responsibility under Keeping children safe in education (KCSIE) to keep children safe online, and the DfE ties its cyber security standards to it.
- Academy trusts must put proportionate controls in place against cybercrime and should take appropriate action to meet the DfE standards, under paragraph 6.14 of the Academy Trust Handbook 2026, effective from 1 October 2026. Paragraph 6.15 bans paying any ransom or extortion demand.
What do the DfE cyber security standards require?
The DfE cyber security standards are seven standards that share the work between senior leaders and IT support. We checked them on 13 October 2026 (page updated 16 September 2026).
| DfE standard | What it asks for | Does Cyber Essentials assess it? |
|---|---|---|
| Conduct a cyber risk assessment annually and review every term | Identify and record the risks to your assets, data and network | No |
| Create and implement a cyber awareness plan for students and staff | Training at least annually for students, staff and at least one governor or trustee | No |
| Secure digital technology and data with anti-malware and a firewall | Correctly configured firewalls, anti-malware with a central monitoring console, and IT support approving applications | Largely, through the firewall, secure configuration and malware protection controls |
| Control and secure user accounts and access privileges | MFA for staff accounts with cloud or remote access and for IT admin accounts, and admin accounts kept off routine work | Yes, through user access control |
| License digital technology and keep it up to date | Licensed technology, with high and critical vulnerability fixes applied within 14 days | Yes, through security update management |
| Develop and implement a plan to back up your data and review this every year | Three copies of data, two on separate devices and one off site | No, backups are recommended but not required |
| Report cyber attacks | Your RPA or insurer, Report Fraud and the DfE sector cyber team, plus the ICO or NCSC where needed | No |
The technical rows line up closely. Both set a 14-day deadline for high and critical fixes (a CVSS v3 base score of 7.0 or above), and the NCSC requires MFA on all cloud services. A current certificate is therefore strong evidence for three of the seven standards, though the DfE adds details Cyber Essentials does not check, such as the central anti-malware console.
If your school or trust is a member of the DfE’s risk protection arrangement (RPA), the 2026 to 2027 membership rules make four things conditions of cyber cover: backups at the level shown above, annual NCSC training for employees and governors with access to school IT, registration with Police CyberAlarm and a cyber response plan. Cyber Essentials is not one of them. Our ransomware prevention guide covers backup and recovery.
Are student devices in Cyber Essentials scope?
School-owned devices are in scope whoever uses them; students’ own devices are not, under the NCSC’s Requirements for IT Infrastructure v3.3, which also say devices you loan to a third party must be included.
| Device or service | In Cyber Essentials scope? |
|---|---|
| Staff laptops, desktops and tablets owned by the school | Yes |
| Classroom and ICT suite devices, and laptops or tablets loaned to students | Yes, because the school owns them |
| Staff personal phones or laptops that open school email or files | Yes, as bring your own device (BYOD) |
| Students’ own phones and laptops | No, but keep them on a separate guest network |
| Cloud services such as email, the learning platform and a cloud-hosted MIS | Yes, cloud services cannot be excluded |
| Exam or curriculum machines on a segregated network with no internet access | Can be excluded through a defined sub-set, agreed with your assessor |
The NCSC says you remain responsible for confirming that out-of-scope devices using your services and data are configured correctly, so filtering, monitoring and your acceptable use policy still matter. Settle two points early: shared classroom logons, because Cyber Essentials requires unique credentials, and how student accounts in your cloud tenant are treated. Staff BYOD rules are covered on our Cyber Essentials scoping questionnaire page.
How do academy trusts get Cyber Essentials?
Most multi-academy trusts certify the whole trust at once. A trust is a single legal entity, so one application can cover every academy, the central team and the shared cloud tenant, priced on total staff rather than per school.
| Approach | When it works | What to watch |
|---|---|---|
| Whole-trust certificate | Central IT, one cloud tenant, common device builds | Every school must meet all five controls before you submit |
| One academy as a sub-set | The school’s network is segregated from the rest of the trust by a firewall or VLAN | Shared cloud services stay in scope, and the boundary must be agreed with the assessor first |
| Phased approach | Schools join the trust on different IT | Certify the schools on the central platform first, keep the others segregated, then widen the scope at renewal |
For Cyber Essentials Plus, the assessor samples devices per operating system version, not per school, so standard builds keep the audit short. It must be completed within three months of the basic certificate, and we usually run it remotely by screen share.
What if a shared IT provider or local authority runs your IT?
Your provider’s work is part of your assessment, and the DfE suggests asking whether your IT support is certified to Cyber Essentials or Cyber Essentials Plus. Under the NCSC requirements, accounts your school owns are in scope even when a supplier or managed service provider uses them, and you must be able to confirm the controls are met on any externally managed service. The DfE adds that you should discuss with outsourced IT support how it meets each standard, and review any gaps no later than your next contract renewal.
IT providers supporting several schools can see how we certify them and their clients in our Cyber Essentials partner programme.
Free cyber security for schools: where to get training and help
Much of the help a school needs is free. The NCSC and the DfE publish training, tools and guidance written for schools, and the NCSC’s Cyber Security for Schools page gathers them in one place, including questions governors and trustees can ask.
| Free resource | Provided by | What it gives you |
|---|---|---|
| Cyber security training for school staff | NCSC | A scripted presentation pack for INSET days or staff meetings, and a self-learn video for individual staff, which covers the annual training the DfE standards and RPA rules ask for |
| Cyber Security Hub | DfE | Guidance for schools in England on backups, MFA and protective DNS, a cyber response plan template, and immediate steps if you are under attack |
| PDNS for Schools | NCSC | A protective DNS service that blocks access to known malicious websites |
| Police CyberAlarm | Police | Monitoring of your internet connection for suspicious traffic; registration is one of the RPA cyber cover conditions |
| Check your cyber security | NCSC | Remote, non-intrusive checks of your website, email security and browsers |
| Exercise in a Box | NCSC | A way to rehearse your cyber response plan with staff and governors |
Free resources build awareness and plans, but they do not give a governing board, trust or insurer independent evidence that the technical controls work. That is the role Cyber Essentials plays, so the two work together: free training and planning for the people side of the DfE standards, certification for the technical side.
How much does Cyber Essentials for schools cost?
Our Cyber Essentials packages are priced per certificate by total staff, including part-time staff, and exclude VAT.
| Staff (whole school or trust) | Bronze | Silver | Gold |
|---|---|---|---|
| 0 to 9 | £320 | £410 | £510 |
| 10 to 49 | £440 | £520 | £620 |
| 50 to 249 | £500 | £575 | £675 |
| 250 or more | £600 | £650 | £750 |
Packages differ in assessment speed and resubmissions, as set out on our Cyber Essentials cost page. Cyber Essentials Plus is quoted after scoping, as the price depends on device builds and sites.
Why Sovereign Secure
- IASME-licensed certification body. We assess and issue Cyber Essentials and Cyber Essentials Plus certificates ourselves.
- Fixed prices for basic certification, with a pre-assessment check and a support call in every package.
- ISO 27001 certified and a PCI SSC-approved QSA company, useful if your school or trust takes card payments.
- Based in Accrington, Lancashire, assessing schools remotely across the UK.
Get started
Tell us how many schools, staff and devices you have through the Cyber Essentials scoping questionnaire and we will confirm the scope and send a fixed quote. Or call us on +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
