7 Cyber Security Questions To Ask Before Buying EdTech
7 cyber security questions every school should ask before buying any EdTech product
New education technology can save time, improve learning and reduce workload. But before a school asks what a product can do, it should ask how safely it handles pupil, staff and school data.
Artificial Intelligence is transforming education. New learning platforms appear every week. Assessment tools promise to reduce marking. Apps claim to improve attendance, safeguarding and parental engagement.
But before asking “What can this software do?”, schools should first ask “How secure is it?”
The Department for Education’s latest Assessment of the Education Technology Market in England describes cyber security and data privacy as one of the technologies that underpins the wider EdTech ecosystem, alongside AI, cloud infrastructure, accessibility and interoperability.
That is an important shift. Cyber security is no longer something to think about after you have chosen a product. It should be part of the buying decision from the very beginning.
1Where is our data stored?
Pupil information is some of the most sensitive data an organisation can hold. Schools should understand where that information lives, who can access it and what happens to it over time.
Ask the supplier:
- Which country stores our data?
- Is it hosted in the UK, Europe or elsewhere?
- If data is stored outside the UK, what safeguards are in place?
- How is the data backed up?
- How long is data retained after we leave?
Understanding where your information lives is the first step towards understanding your risk.
2How are user accounts protected?
Many cyber attacks do not start with someone breaking through a firewall. They begin with a stolen username and password.
Check whether the platform supports:
- Multi-factor authentication
- Microsoft Entra ID integration
- Single sign-on
- Strong password controls
- Automatic account locking
- Role-based access permissions
The fewer passwords staff have to remember, the lower the chance they will reuse them elsewhere.
3How does the supplier protect your information?
Every supplier should be able to explain how they protect customer data. The answer does not need to be full of jargon, but it does need to be clear.
Look for evidence such as:
- Cyber Essentials or Cyber Essentials Plus
- ISO 27001 certification
- Regular penetration testing
- Vulnerability management
- Secure software development
- Independent security audits
You do not necessarily need every certification, but you should expect sensible answers. If a supplier cannot explain its security, that is worth exploring further.
4What happens if the supplier suffers a cyber attack?
Incidents happen. What matters is how quickly and honestly an organisation responds.
Ask:
- How will we be notified?
- How quickly will we be told?
- Is there a documented incident response process?
- Can the supplier restore data?
- Has the supplier tested its recovery process?
- Who is responsible for communication during an incident?
This conversation should not be awkward. A good supplier will expect these questions.
5What information does the product actually need?
One of the best ways to reduce cyber risk is to minimise the amount of information you share in the first place.
Ask yourself:
- Does this platform really need every pupil record?
- Does it need staff personal data?
- Does every member of staff need administrator access?
- Can permissions be restricted?
- Can old accounts be removed automatically?
Collecting less data usually means protecting less data. That is often the simplest form of risk reduction.
6How will the product integrate with Microsoft 365 or Google Workspace?
Many schools now use Microsoft 365 or Google Workspace as the centre of their digital environment. That makes integrations powerful, but also important to review carefully.
Before connecting another application, ask:
- What permissions does it require?
- Does it need administrator approval?
- Can permissions be restricted?
- What data will it access?
- Can those permissions be reviewed later?
- Can access be removed quickly if needed?
From the field: One of the first questions we ask suppliers is not “What does it do?” It is “What permissions does it need?” We have seen legitimate applications request far more access than they actually require. That does not automatically make them unsafe, but schools should understand what they are approving before clicking accept.
7What happens when we stop using it?
Schools often focus on buying technology. They spend much less time planning how they will leave.
Before signing a contract, ask:
- How do we export our data?
- In what format will it be provided?
- How long is our information retained?
- Will accounts be deleted automatically?
- How do we verify our data has been securely erased?
An exit strategy is just as important as an implementation plan.
Security should be part of procurement, not an afterthought
The DfE’s latest research found that schools often struggle with evaluating products, long-term planning and procurement decisions.
That is understandable. Schools are expected to navigate hundreds of suppliers while balancing budgets, compliance, teaching priorities and increasing cyber threats.
The good news is that asking a handful of sensible security questions before buying new technology can significantly reduce risk later.
Technology should make life easier. It should not introduce unnecessary cyber risk.
Need an independent second opinion?
Black Swan Cyber Security Solutions helps schools and trusts assess cyber security alongside functionality, compliance and value for money.
Book a free cyber reviewFAQs
Should schools only buy from Cyber Essentials certified suppliers?
Not always, but Cyber Essentials or Cyber Essentials Plus is useful evidence that a supplier takes basic security controls seriously. If a supplier is not certified, ask what equivalent controls they have in place.
Does GDPR cover all of this?
GDPR is important, but data protection and cyber security are not the same thing. A product may have a privacy notice and still need stronger technical controls around access, monitoring, backups and incident response.
Who should ask these questions?
Ideally, procurement, IT, data protection and school leadership should work together. Cyber security is not just an IT issue. It is part of good governance.
Can Black Swan review a supplier before we buy?
Yes. We can help review supplier responses, ask follow-up questions and identify practical risks before you commit to a new EdTech product.