In short: Cyber Essentials for schools is optional but closely aligned with the DfE's cyber security standards for schools and colleges, last updated 16 September 2026. Colleges must hold Cyber Essentials under their funding agreement. Schools that meet the DfE standards on firewalls, anti-malware, accounts, MFA and 14-day updates are well on the way to certification.
Is Cyber Essentials required for schools?
The DfE's cyber security standards for schools and colleges (last updated 16 September 2026) set out what it expects. On Cyber Essentials specifically:
- Colleges must hold Cyber Essentials as a condition of their funding agreement.
- Schools, including academies, can choose to certify. It is not mandatory for them, but the DfE presents the standards as a route that helps towards certification.
- Outsourced IT providers. The DfE suggests schools and colleges ask their IT support provider whether it holds Cyber Essentials or Cyber Essentials Plus.
Separately from certification, the DfE presents the standards as its recommended approach for every school and college, with timescales set standard by standard, so the technical work overlaps heavily whichever way you go. Certification adds independent evidence that the work has been done, which is useful when governors, trusts or insurers ask.
How the seven DfE standards map to Cyber Essentials
The DfE lists seven standards. Some match Cyber Essentials controls directly; others go beyond it into governance, training and recovery.
| DfE standard | Relationship to Cyber Essentials |
|---|---|
| 1. Annual cyber risk assessment, reviewed each term | Not a Cyber Essentials control, but the asset list it produces is the starting point for your scope |
| 2. Cyber awareness plan for students and staff | Not assessed by Cyber Essentials; supports the people side. See security awareness training |
| 3. Anti-malware and a firewall | Matches the Firewalls and Malware Protection controls |
| 4. Control and secure user accounts and access privileges | Matches User Access Control, including MFA and separate admin accounts |
| 5. License digital technology and keep it up to date | Matches Security Update Management, including the 14-day rule |
| 6. Back up data and review the plan every year | Cyber Essentials strongly recommends backups but does not test them |
| 7. Report cyber attacks | Outside Cyber Essentials; part of incident response |
Cyber Essentials' Secure Configuration control (removing unused accounts and software, changing default passwords, locking devices) has no standard of its own in the DfE list, but you still need it to pass.
Updates, MFA and accounts: where the DfE and Cyber Essentials agree
The most demanding technical expectations line up closely:
- 14-day updates. The DfE standard asks for fixes to operating systems, applications and firmware within 14 days of release where the vendor rates them critical or high, the CVSS v3.1 base score is 7.0 or above, or no severity is given. That mirrors the Cyber Essentials rule, and under the Danzell question set missing it is an automatic fail. The DfE also expects its own security instructions to be applied within 5 working days.
- Unsupported technology. Both expect devices and software to be licensed and supported. Ageing classroom laptops and staff machines still on unenrolled Windows 10 are a common problem.
- MFA. The DfE expects MFA on all staff accounts with cloud or remote access and on IT admin accounts. Cyber Essentials requires MFA on every cloud service that offers it; a cloud service without it fails the whole assessment. See Cyber Essentials MFA.
- Firewalls off site. The DfE expects a software firewall on devices used at home or on public wifi, which matches the Cyber Essentials position on home routers and untrusted networks.
- Removable media. The DfE also expects USB storage to be blocked by default unless there is a specific need. Cyber Essentials does not require this, but it supports the Secure Configuration and Malware Protection controls.
For MFA options beyond the built-in Microsoft and Google methods, see Cisco Duo MFA.
Pupil devices, BYOD and staff working from home
Scope is where education settings need to think hardest:
- Staff own devices. A teacher's personal phone or laptop that opens school email, the management information system or cloud files is in scope and must meet every control. Many schools find it easier to provide devices or restrict access from unmanaged ones. See BYOD and home working.
- Student-owned devices. The NCSC's device ownership table treats student-owned devices as out of scope. They still need managing for safeguarding and network reasons, so keep them on a separate guest network.
- School-owned devices given to pupils. The NCSC requirements say organisation-owned devices loaned to others must be included, so plan for them to be in scope or placed in a properly segregated sub-set.
- Classroom and curriculum networks. A sub-set must be separated by a firewall or VLAN and must still include end-user devices; cloud services such as Microsoft 365 or Google Workspace for Education cannot be excluded. See cloud services and Cyber Essentials.
- Staff home working. Home devices are in scope; a home router the school did not supply is not, so a software firewall is needed on the device.
Mobile device management, such as Microsoft Intune, is the practical way to apply screen locks, updates and app controls across a fleet of staff and pupil devices.
RPA cover and what Cyber Essentials does not cover
Schools in the Risk Protection Arrangement should note that the DfE standards page lists conditions for RPA cyber cover, including having a cyber response plan, backing up to the level the DfE backup standard describes (at least three copies of important data, on at least two separate devices, with at least one off site) and evidencing that relevant users complete the free NCSC cyber training each year. Check the RPA's own terms for the detail.
None of those conditions is tested by Cyber Essentials. Certification proves the technical baseline; your response plan, backups and training still need their own evidence. Forever Group can help with cloud backup, and staff and governor training is covered on security awareness training for employees.
How we help schools and colleges
Forever Systems prepares schools, trusts and colleges for Cyber Essentials and works alongside an IASME-licensed Certification Body for the assessment. We do not issue certificates. A typical engagement covers:
- A gap analysis against the current question set, cross-referenced to the DfE standards
- A device and software inventory, highlighting unsupported operating systems and late updates
- A review of your Microsoft 365 or Google Workspace tenant for MFA coverage and admin accounts
- Firewall and wireless review, including how staff, pupil and guest networks are separated
- Support through the self-assessment and, for colleges or trusts that want it, Cyber Essentials Plus
Pricing depends on the number of sites and devices, so ask us for a quote. Contact us to plan your route.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Do schools have to have Cyber Essentials?
No. The DfE's cyber security standards make Cyber Essentials a requirement for colleges under their funding agreement and optional for schools. Schools are still expected to meet the DfE standards, which overlap heavily with Cyber Essentials.
Do colleges need Cyber Essentials or Cyber Essentials Plus?
The DfE standards say colleges must hold Cyber Essentials under their funding agreement. Check your own funding agreement and any contracts for the level required; some colleges choose Cyber Essentials Plus for the extra assurance of hands-on testing.
Are pupils' own devices in scope for Cyber Essentials?
The NCSC's device ownership table treats student-owned devices as out of scope. Devices the school owns and gives to pupils, and staff personal devices that access school data, are a different matter and normally need to meet the controls.
What are the DfE cyber security standards for schools?
They are seven standards covering annual risk assessment, a cyber awareness plan, anti-malware and firewalls, user accounts and access, licensing and updates, backups, and reporting cyber attacks. The page was last updated on 16 September 2026.
Does Cyber Essentials meet the RPA cyber cover conditions?
Not on its own. The RPA conditions listed by the DfE include a cyber response plan, backups to the DfE backup standard and annual NCSC training for relevant users, none of which Cyber Essentials tests.