Cyber security FAQs for Schools and MATs
Work with a team that understands the challenges schools face every day. We help you strengthen cyber security without the jargon, the overwhelm or the inflated costs. Just practical guidance, clear answers and lasting protection for your staff, students and data.
Across Derbyshire and the rest of the UK, schools and Multi-Academy Trusts are asking the same important questions about cyber security.
Do we really need it?
What does it actually protect us from?
And how much should we be spending on it?
These are exactly the right questions to ask. In this guide, we’ll give you clear, jargon-free answers so you can make confident, informed decisions about protecting your school, trust, or organisation.
At Black Swan Cyber Security Solutions, we’ve worked with countless headteachers, IT leads, and business managers to build practical, affordable cyber resilience strategies, without the technical overwhelm. Our goal is simple: to help you understand what matters, why it matters and how to take the next step with confidence.
Should our school invest in cyber security? Even if we have RPA cover?
Investment in cyber security is necessary even if your trust or school is a member of RPA. The RPA provides a layer of financial protection for certain losses, but only if you meet its conditions (and many are conditional on you having robust security in place). For example, under the latest membership rules, all members must meet the DfE standard relating to backups (e.g. 3 copies, stored across distinct locations) to maintain cover under the cyber section.
Also, RPA is not a substitute for proactive cyber defences. A breach can damage your reputation, disrupt operations or lead to non-financial losses that RPA might exclude. Strong cyber security helps reduce the risk of needing to rely on RPA in the first place.
In addition, the DfE cyber standards require regular risk assessments, governance, hardware/software registers, user controls, monitoring, incident response plans, etc. Meeting those standards strengthens your ability to remain eligible for RPA claims (and helps avoid exclusions).
So investing in security is both a compliance measure and a practical one.
Do we need cyber security if we already use cloud systems (e.g. Google Workspace / M365)?
Using cloud systems does not relieve you of responsibility under DfE standards or RPA rules. In fact, some RPA cyber cover depends on certain safeguards you must have in place, such as:
Offline backups (i.e. backups that aren’t permanently connected to your live systems)
A documented cyber incident response plan
All staff and governors with access to IT systems must have undergone cyber security training
Registration with Police CyberAlarm
Cloud systems still require protections: encryption, access control, contract clauses with providers, accounts lifecycle control, patching, monitoring, etc. If those aren’t well managed, it can invalidate your eligibility to claim under RPA’s cyber cover.
We’ll audit your cloud setup and strengthen those control layers so you stay eligible and compliant.
Is cyber insurance or RPA enough protection for our MAT (or school)?
Neither RPA nor conventional cyber insurance should be treated as a substitute for proper security practices. They are compensatory, not preventative.
With RPA:
RPA includes a cyber cover section with a limit for any one loss (for example, in recent rules, £250,000 per loss and up to an aggregate amount for the group)
To rely on RPA for a cyber-related claim, you must meet all its conditions (backups, training, response plan, etc.). If you fail those, the claim may be denied.
RPA is not an insurance product – it’s a government-backed risk pooling scheme. It operates by rules and exclusions, not policy underwriting.
With commercial cyber insurance:
Some schools (especially non-academy ones) may still prefer or require insurance in addition to RPA, especially for risks outside RPA’s scope.
Insurers may demand strong baseline security practices before issuing or renewing policies.
We help MATs ensure they satisfy both RPA conditions and commercial insurance prerequisites, where needed, so there’s no coverage gaps.
How much should cyber security cost for a school / MAT (accounting for RPA)?
Costs vary depending on your infrastructure, risk profile, number of sites, legacy systems, etc. But your plan should cover the mandatory controls required by DfE standards (patching, backups, network security, filtering/monitoring, incident response), plus some buffer for audit, training and compliance.
Because RPA requires certain security measures to remain eligible for claims, your costs may include “keeping up to standard” investments. That said, many schools can meet a baseline of compliance on realistic education budgets, especially when the alternative (a refused claim or a major breach) would be much costlier.
We design packages for schools and trusts that balance cost, risk, and compliance – including taking into account what the RPA expects.
What’s the best cyber security structure for MATs with multiple sites?
A centralised, standardised approach is vital. Under both DfE standards and RPA expectations, you benefit from:
Unified policies (access control, patching, backups, monitoring)
Centralised user account and privilege management
Consistent incident response plans across all sites
Shared filtering and monitoring systems
Consistent hardware/software registers across the MAT
This consistency helps you meet standards once, scale control, reduce duplication, and maintain eligibility for RPA claims (since failing at a single site might jeopardise a group-level claim).
We help MATs roll out this approach, covering governance, technical frameworks and oversight.
Should we get Cyber Essentials certification (or similar)?
Yes, if possible. Cyber Essentials aligns well with many DfE baseline requirements (firewalls, patching, account control, etc.). While RPA membership rules do not currently require Cyber Essentials per se, having it strengthens your evidence of committed cyber practices, which could help in a claim review or interaction with insurers.
We can support your school or trust in achieving Cyber Essentials and ensure that its controls align with both DfE standards and RPA expectations.
Is staff cyber awareness training really necessary (and required for RPA)?
Yes, it’s not optional. Under DfE cyber security standards, schools must have a staff (and where appropriate student) cyber awareness programme.
Under RPA’s cyber cover rules, all employees and governors with access to IT systems must complete NCSC / equivalent cyber training to qualify for cover.
We offer sector-appropriate training, phishing simulations and policy reinforcement to make sure your staff are a strength, not a weakness, in your security posture.
Do small primary schools really get targeted and does RPA help them?
Yes, small schools are often seen as soft targets due to fewer resources or less specialist IT security.
RPA can help mitigate financial risk for certain qualified losses, but only if the school has maintained all required security controls. If controls are weak, RPA could decline a claim.
Even for small settings, simple but robust measures (backups, MFA, monitoring, governance) make a strong difference in both protection and eligibility for RPA.
How can we measure our school’s current cyber risk, (or maturity), especially considering RPA criteria?
A well-structured cyber maturity audit is the first step. The audit should map your current state against:
DfE cyber security standard domains (governance, user control, backups, filtering, incident response, monitoring, etc.)
RPA’s specific cyber cover conditions (backup rules, training completion, response plan, etc.)
Identified gaps, priorities, and remediation roadmap
Your audit report should explicitly tell you whether you currently meet all RPA cyber conditions and where you’re exposed.
We deliver detailed but digestible reports and help you close the gaps.
What’s the first step to improving our cyber security, especially with RPA in mind?
Start with a cyber health check tailored to DfE standards and RPA conditions. We’ll walk you through:
Your current posture vs required controls
Your eligibility status under RPA’s cyber cover
A prioritised action plan (quick wins + longer-term investments)
From there, you can plan for compliance, funding or phased improvements, always keeping in view both standards and RPA eligibility.
What filtering & monitoring obligations do we have (and how do they relate to RPA)?
Under DfE standards, you must:
Assign roles for managing and reviewing filtering & monitoring systems
Review filtering settings, escalation procedures and logs at least annually
Ensure filtering doesn’t overly block educational content
Use monitoring tools to detect suspicious activity, ransomware, or safeguarding concerns
Have an incident response policy in place to act on alerts
From an RPA perspective, failing to maintain proper monitoring or acting on alerts may weaken your claim arguments if you cannot show you met expected standards.
We help you implement a proportionate, sustainable filtering/monitoring regime that aligns with both compliance and claim-readiness.
Who is responsible for cyber security in a school or MAT?
Under the DfE standards, senior leaders, not just IT staff, are accountable for cyber security.
How often should we review our cyber security risks?
The DfE requires schools to carry out a cyber risk assessment at least annually, and review it each term.
This ensures that leadership stays aware of emerging threats, new technologies, and compliance gaps.
Do we need to use multi-factor authentication (MFA)?
Yes – MFA is explicitly part of the DfE standards for user account protection.
It’s required for all privileged accounts (administrators, IT leads, SLT) and strongly recommended for all users where possible.
How should we manage staff leavers and new starters?
DfE standards require that user accounts are promptly disabled when staff leave, and that access is reviewed regularly to maintain the “principle of least privilege.” A documented “joiners, movers, leavers” process is key.
Should pupils have individual logins or shared accounts?
Shared accounts are strongly discouraged under DfE standards.
Every member of staff should have their own login credentials, and appropriate filtering and monitoring applied based on role.
What are the minimum technical protections we must have in place?
DfE standards specify baseline controls:
Active, up-to-date anti-malware
Managed firewalls protecting all network connections
Regular patching and updates for all systems
Secure configuration (disabling unnecessary accounts and services)
Network segmentation (keeping admin systems separate from teaching networks)
How should we manage software updates and end-of-life systems?
You must have a process for:
Tracking devices and software versions
Applying security updates promptly (within 14 days for critical patches)
Replacing or isolating devices/software that have reached end of life
What are the DfE requirements for backups?
You must have at least 3 copies of your data, stored across 2 different locations, with 1 copy offline.
Backups must be tested regularly to ensure recovery is possible. We can help implement a compliant 3-2-1 backup strategy and automate regular testing.
What should we do if we suspect a cyber attack?
Under DfE and RPA guidance, you should:
Activate your incident response plan
Isolate affected systems
Report to the National Cyber Security Centre (NCSC) and Police CyberAlarm
Notify the DfE (via RPA or if a significant breach occurs)
Inform the ICO if personal data is compromised
Do we need to register with Police CyberAlarm?
Yes, for RPA cyber cover, you must register with Police CyberAlarm and maintain that registration to qualify for cover.
It also provides free threat data sharing and alerts, helping you stay protected.
Who needs cyber security training in a school or MAT?
Under DfE standards, all staff and governors with IT access must receive regular cyber training.
Training should be role-specific, covering data protection, phishing and password hygiene. We deliver tailored training for teachers, admin staff, and leadership teams.
How often should staff receive cyber training?
DfE guidance recommends at least annual training with refreshers after incidents or system changes. We recommend more little and often training each month on the latest threats.
How can we build a cyber-aware culture across our schools?
Create a culture of openness and encourage staff to report suspicious emails or incidents without fear of blame.
Regularly share reminders, tips and real examples from the education sector.
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.
Stay ahead of cyber threats - Subscribe to the Black Swan newsletter
Protect your school or business with expert advice tailored to schools and small businesses. Get the latest cyber threat insights, practical data protection tips, and guidance on password security, ransomware prevention, and compliance – all delivered straight to your inbox.
Join the Black Swan community today and take charge of your cyber security.
Click here to preview an example newsletter and see what you’ll gain by subscribing!