Cyber security & compliance, explained for schools
Plain-English guides to the standards UK schools and multi-academy trusts are actually being asked about — no jargon, no scaremongering.
Start here3
The cornerstone guides — written for the person who runs the school, the governing body, and the trust.
Start here3
The cornerstone guides — written for the person who runs the school, the governing body, and the trust.
Cyber security for schools
How schools actually get attacked, what to protect first, and what evidence leaders and governors should expect — written for the person who runs the school, not the network.
Cyber security for governors
Ten questions a governing body can ask about cyber security — with the answers that should reassure you and the ones that shouldn't. No technical knowledge assumed.
Cyber security for multi-academy trusts
How a MAT actually governs cyber risk across an estate — the central/academy split, honest visibility, consent boundaries, reporting trustees can use, and the questions central teams should be asking.
Topic hubs5
One authoritative home per subject — email security, the DfE standards, Cyber Essentials, Microsoft 365, and the glossary.
Topic hubs5
One authoritative home per subject — email security, the DfE standards, Cyber Essentials, Microsoft 365, and the glossary.
Email security for schools
The four DNS records that stop someone sending email as your school, what each one does, and how to check yours from the public records anyone can read.
The DfE cyber security standards, explained for schools
What the DfE's cyber security standard actually requires, in plain English — each expectation, who implements it, and what evidence a school should keep. Official wording cited throughout.
Cyber Essentials for schools
What Cyber Essentials is, when a school actually needs the certificate, the five control areas, what Plus adds, and how to prepare — with the honest line between readiness and certification.
Microsoft 365 security for schools
What good Microsoft 365 security looks like in a UK school — identity, MFA, Conditional Access, Defender and the licence tiers, with the school/IT-provider split and the evidence leaders should expect.
The school cyber security glossary
Plain-English definitions of the terms schools actually meet — each with what it means for a school specifically, and a link to the guide that covers it properly.
Practical guides & articles10
The hands-on pieces — checklists, rollouts, comparisons, and the record-by-record how-tos.
Practical guides & articles10
The hands-on pieces — checklists, rollouts, comparisons, and the record-by-record how-tos.
DMARC for schools: what it is, why it matters, and how to roll it out
A plain-English guide to DMARC for schools — how it works with SPF and DKIM, what none, quarantine and reject actually do, and how to move to reject without losing legitimate mail.
Email spoofing: how someone sends email as your school, and how to stop it
What email spoofing looks like, why schools are worth impersonating, what SPF, DKIM and DMARC each do about it — and the practical steps that close the gap.
The school cyber security checklist
A practical checklist a school can work through without a security team — grouped by what to do first, mapped to the DfE cyber security standard, and printable for the next leadership meeting.
Cyber Essentials vs Cyber Essentials Plus: which does your school need?
The genuine differences — self-assessment against independent technical testing, what each costs and proves, the timing that links them, and when a school should choose each.
MFA for schools: registered, enforced, and the difference that matters
Rolling out multi-factor authentication in a school without locking anyone out — registration versus enforcement, exceptions, recovery, break-glass accounts, and what to do about shared and student accounts.
School identity security: Entra ID and Conditional Access, together
Why identity is the new perimeter for schools — what Entra ID actually is, what Conditional Access adds and what licence it needs, and policies that protect staff without locking teachers out at 8:45am.
Microsoft Defender for schools: what your licence actually includes
The Defender family untangled for schools — what each product does, which licence tier carries which plan, and the configuration reality: owning a licence is not the same as being protected by it.
SPF, DKIM, DMARC, MTA-STS and TLS-RPT: the email records every school needs
A plain-English guide to the DNS records that stop someone sending email as your school — what each one does, what happens if it is missing, and how to put it right with whoever runs your DNS.
Meeting the DfE Digital & Technology Standards: a cyber security checklist for schools
A plain-English walkthrough of the DfE's cyber security standards for schools and colleges — what each one means, who owns it, and a practical checklist to evidence compliance.
The NCSC Cyber Assessment Framework (CAF) for schools, explained
What the NCSC CAF is, why multi-academy trusts are increasingly being asked about it, and how to approach its four objectives without a security team.
Free posters7
Seven printable A3 sheets for staff rooms and offices — no email gate, free to share.
Free posters7
Seven printable A3 sheets for staff rooms and offices — no email gate, free to share.
- Four things to check before you clickStaff room · The four questions that catch almost every phishing email, in about ten seconds.A3 PDF
- Three words beat three symbolsStaff room · Why the NCSC's three-random-words advice is stronger than P@ssw0rd1, and why you should stop forcing termly changes.A3 PDF
- Two-step sign-in, in one minuteAnyone with a school login · What it is, what it is not, and why a prompt you did not ask for is the alarm.A3 PDF
- You clicked it. Now what?By the door · The next ten minutes, and the reassurance that nobody is in trouble for reporting.A3 PDF
- “Hello, it's IT. Read me the code.”School office · Not every attack arrives by email. Some of them ring you and sound friendly.A3 PDF
- The invoice that isn'tFinance office · The most expensive attacks on schools are a normal invoice with new bank details.A3 PDF
- Five minutes before you goBefore the holidays · Attacks cluster around holidays because nobody is watching. Five minutes now saves a fortnight.A3 PDF
Want to see them first? Preview all seven →