Cyber Essentials for schools and academy trusts means proving five basic technical controls are in place — and in 2026 more multi-academy trusts (MATs) get asked for that certificate before they can bid for capital grants, renew cyber insurance, or sign a data processing agreement with a new MIS supplier.
Why this matters
The Department for Education published its cyber security standards for schools and colleges in 2023, and by 2026 most local authority and MAT procurement frameworks reference Cyber Essentials directly. The National Cyber Security Centre continues to flag schools and academy trusts as a repeat ransomware target, largely because pupil data, safeguarding records, and exam systems sit on the same network as ageing MIS servers.
Insurers have followed. A growing share of school cyber policies now ask for a valid Cyber Essentials certificate at renewal, and grant-funded capital projects increasingly list it as a prerequisite. Cyber Essentials for schools isn't a nice-to-have in 2026 — it's turning into a gate you can't get through without.
Who this is for
This guide is built for the person who actually owns the certification task: a school business manager juggling it alongside budgets, a MAT-level IT lead covering 5 to 30 sites, or a DPO trying to keep safeguarding data and Cyber Essentials evidence in the same place. If you're choosing between a self-assessment form, an IT support contract, or an automated platform like OneClickComply, the right call depends almost entirely on how many sites you're certifying and how often your evidence needs refreshing.
What to look for in Cyber Essentials for schools
Scope that matches your trust structure
A single academy and a 20-school MAT need completely different scoping. Get this wrong and you either under-certify a site that handles sensitive data or pay to re-scope every site individually when one shared certificate would have worked.
Evidence collection that doesn't sit on one inbox
Cyber Essentials asks for evidence against firewalls, secure configuration, security update management, user access control, and malware protection — five control themes in total. If that evidence lives in one IT technician's inbox, it disappears the day they leave or go on leave during renewal week.
Renewal tracking built for the 12-month cycle
Certification is valid for 12 months, then you're back to square one. Trusts that miss the renewal window usually find out when a funder or insurer asks for the current certificate, not before.
Alignment with DfE's cyber security standards
The standards published in 2023 map closely onto Cyber Essentials controls but go further on areas like backup and recovery. Picking a route that only satisfies the bare minimum leaves gaps a school improvement audit will flag later.
A clear path to Cyber Essentials Plus if you handle sensitive data
Plus adds an external technical audit on top of the self-assessment. Trusts bidding for government-funded projects or handling special category data for a large pupil population should plan for this from day one, not bolt it on after a failed bid.
Cost that scales with sites, not a flat per-school fee
A MAT paying full consultancy day-rates per school for identical evidence gathering is paying for the same work multiple times over.
Top picks: routes to Cyber Essentials for schools
IASME self-assessment portal — the cheapest route. One standard question set, submitted directly through the scheme's official channel, valid for 12 months. Works when a single school has an IT lead who understands the five controls and has two or three hours to spare. Consider for a standalone academy under 200 staff; Skip for a MAT with more than two sites, because the manual form doesn't scale and evidence gets re-typed every time.
Local IT support provider filing on your behalf — the traditional route. Your managed service provider fills in the form using access they already have to your network. It removes the admin burden but ties renewal to whoever holds that contract, and evidence quality varies by provider. Hold if your current MSP already tracks renewal dates proactively; Skip if you've had to chase them for basic tickets in the last 12 months.
Automated compliance platform such as OneClickComply — the scalable pick. Evidence collection, control mapping, and renewal reminders run centrally instead of per-school, which matters once you're managing more than a handful of sites in 2026. Buy for MATs running 3 or more sites where the same five controls need proving repeatedly across different local IT setups.
Cyber Essentials Plus with an external assessor — the trust-wide requirement. The assessor runs technical tests on top of your self-assessment, typically scheduled within a few months of passing the base level. Trusts handling sensitive pupil data or bidding on public-sector frameworks should look at how this works for Cyber Essentials Plus in NHS supplier contexts as a close parallel — same audit mechanics, different sector. Consider if a grant, insurer, or framework explicitly asks for Plus; Skip if you've never been asked and have no pending bids.
MAT-wide certification via a lead school — the consolidation play. One school's certificate is extended to cover shared infrastructure across the trust, which cuts duplicate paperwork when sites share a network domain. Consider only where IT infrastructure is genuinely centralised; it's the wrong call if each academy runs its own separate network.
What to avoid
- Generic cyber security policies that don't map to the five controls. A policy document that looks thorough but doesn't reference firewalls, secure configuration, patching, access control, or malware protection won't survive an assessor's questions.
- Buying Cyber Essentials Plus before anyone's asked for it. The external audit adds cost and scheduling overhead; get base-level Cyber Essentials solid first unless a specific bid or insurer requires Plus now.
- Letting renewal sit with one named individual. Academy trust staff turnover is high enough that a certificate tied to one person's calendar reminder is a certificate that lapses.
Get Cyber Essentials sorted for your trust
See how automated evidence collection handles renewal across every site.
Verdict comparison
| Route | Cost signal | Time to certify | Best for | Verdict |
|---|---|---|---|---|
| IASME self-assessment | Lowest | Days | Single small academy | Consider |
| IT support provider files it | Mid | 1-2 weeks | Trust with a responsive MSP | Hold |
| Automated platform (OneClickComply) | Scales with sites | Days per site | MATs with 3+ sites | Buy |
| Cyber Essentials Plus | Highest | Weeks (external audit) | Trusts bidding on grants/frameworks | Consider |
| MAT-wide lead school certificate | Mid | Weeks | Centralised trust IT | Consider |
Frequently asked questions
One last thing
The control most academy trusts fail first isn't the firewall — it's malware protection, and almost always because of unmanaged personal devices used for marking or lesson planning outside the school network. Fix BYOD device policy before you touch anything else and the rest of the five controls get noticeably easier to evidence in 2026.