Cyber security for schools and academy trusts

Schools are attacked more often than the average business, and most rely on DfE cover that only pays out if certain conditions are met.

Why schools are a target

The government's Cyber Security Breaches Survey consistently finds that schools and colleges face more breaches and attacks than businesses of a similar size, while the share with a cyber risk assessment or a written policy has fallen.

RPA cyber cover: the conditions

Most academy trusts and many maintained schools use the DfE's Risk Protection Arrangement (RPA) instead of commercial insurance. It includes cyber cover, but only if you meet its conditions, which include:

• Offline backups of important data, meeting the DfE's standard on backups.
• NCSC cyber security training completed by staff with access to the school's IT, and governors or trustees.
• Registering with Police CyberAlarm, a free monitoring tool from your local police cyber team.
• A cyber response plan in place.

Check the current RPA membership rules for your type of school. If you can't evidence a condition, a claim may not be paid.

The DfE cyber security standards

The DfE publishes cyber security standards for schools and colleges in England, covering things like backups, patching, user accounts, multi-factor login and an annual risk assessment. They overlap heavily with Cyber Essentials.

Where Cyber Essentials fits

Cyber Essentials isn't required for schools, but it's a well-recognised way to show the basics are in place. It's often more useful to ask for it from your IT support provider and edtech suppliers, since they have access to your systems. See our guide for IT support providers.