Cyber Essentials is the UK government-backed certification for baseline cyber security — the one schools get asked about by procurement frameworks, insurers and, increasingly, trusts doing due diligence. This page explains what it is, when a school actually needs the certificate rather than just the protections, and how to prepare without wasting a term on it.
What it is, and what it asks
Cyber Essentials is a certification against five technical control areas: firewalls, secure configuration, user access control, malware protection and security update management. The NCSC describes it as the minimum standard of cyber security recommended by government for organisations of all sizes — deliberately baseline, deliberately technical, and assessed against your whole in-scope IT, which for a school includes more devices than anyone remembers until they count.
Why a school pursues it — and when it shouldn’t bother yet
The honest reasons are external: a procurement framework requires it, an insurer asks for it, a trust requires it across its academies, or leadership wants an independent tick that the basics are genuinely done. If none of those apply, the protections matter more than the certificate — a school can implement all five control areas without paying anyone, and our checklist covers the same ground alongside the DfE expectations. The certificate is worth pursuing when somebody you answer to will read it.
Cyber Essentials and Cyber Essentials Plus
Standard Cyber Essentials is a verified self-assessment: you answer the question set, a senior person signs it, and an assessor reviews the answers. Cyber Essentials Plus covers the same controls with independent hands-on technical testing — an auditor checks that what you claimed is actually true on your systems. Certification starts at £320 +VAT for the standard version (the NCSC’s published starting price; Plus pricing depends on the size and complexity of your network — current fees are on the IASME site). The full decision — which one, when, and the timing rule that links them — is its own page: Cyber Essentials vs Cyber Essentials Plus.
Where schools typically come unstuck
- Scope surprises. Staff-owned devices used for school email, forgotten tablets, the office machine running something ancient — scope covers what touches school data, and untidy scope is the commonest source of failed first attempts.
- Out-of-support software. The requirement to run supported, updated software collides with the one legacy system the school can’t replace this year. Plan that conversation before the assessment, not during it.
- MFA that is available, not enforced. The question set asks about what is actually in force. This is the single gap we’d check first.
- The provider split. Your IT provider implements most of the controls, but the school signs the declaration — so the school needs the evidence, not just the reassurance.
Preparing without wasting a term
Read the question set before anything else (it is freely available), walk it with whoever runs your IT, and fix the gaps before booking the assessment — paying to fail is the expensive way to find your gaps. Keep the evidence as you go: enforcement reports, patch cadences, the scope list. That same file answers the governors’ questions and most of the DfE standard — the overlap is large and doing the work once is the point.
Where Ceidwad fits, stated plainly: Atlas tracks your distance from these controls continuously and holds the evidence file, which makes the preparation half largely automatic — and it still isn’t a certificate. The assessment, the declaration and the certificate belong to the certification body, and the wider orientation lives in the complete guide.