How to meet RPA cyber cover conditions and avoid claim rejection
Practical guidance for schools and MATs on meeting the DfE’s cyber security standards, covering daily backups, Police Cyber Alarm, staff training and incident response plans, so your RPA cyber insurance stays valid.
Meet the RPA cyber cover conditions before you need to make a claim.
The DfE Risk Protection Arrangement includes cyber cover, but schools need to be able to show that the required cyber conditions are in place.
This page helps schools understand what those conditions mean in practice: backups, cyber security training, Police CyberAlarm registration and a clear cyber response plan.
We help schools and MATs turn those requirements into practical evidence, so you are not scrambling after an incident has already happened.
RPA cover is not just about having tools. It is about being able to prove the basics are in place.
A school may have backups, training, antivirus and IT support, but still struggle to show clear evidence when it matters.
The risk is not just a cyber attack. It is finding out after the event that backups were not tested, training records were missing, or the response plan was unclear.
That is why we focus on evidence as much as protection.
What schools usually need to evidence for RPA cyber cover.
Offline backups
Schools should meet the DfE backup standard, including multiple copies, separate devices and at least one offline or otherwise protected copy.
Cyber training
Staff and governors with access to school IT systems should complete cyber security training and keep evidence of completion.
Police CyberAlarm
Schools should register with Police CyberAlarm where required, and keep evidence that registration has been completed.
Cyber response plan
Your school should know what happens if systems are compromised, data is inaccessible or a suspicious incident is reported.
Backups are the condition schools most often assume is sorted.
What schools need to think about
- Do you have more than one copy of important data?
- Are backups stored on separate devices or platforms?
- Is at least one copy off-site and offline or protected from ransomware?
- Are restore tests completed and recorded?
- Does SLT know what can be restored and how quickly?
How we help
We help schools review backup coverage, test restore processes, identify weak points and create clearer evidence for RPA, DfE standards, governors and trustees.
That can include server backup, endpoint backup and Microsoft 365 backup for email, Teams, SharePoint and OneDrive.
Training only helps if people complete it, understand it and know what to report.
Staff training
Teachers, support staff, finance, admin and SLT all handle sensitive systems and data. They need clear, practical cyber awareness.
Governor training
Governors and trustees need enough cyber awareness to ask useful questions and understand school risk.
Evidence
Training records should show who has completed training, when it was completed, and where gaps remain.
When something happens, people need to know what to do first.
Your plan should answer practical questions
- Who needs to be told internally?
- Who contacts the IT provider or cyber support?
- How are safeguarding, SLT and governors involved?
- What happens if email is unavailable?
- How do you record decisions during the incident?
It should connect to business continuity
A cyber response plan should not sit in isolation. It should connect to safeguarding, communications, data protection, backup recovery, parent communication and school closure planning.
The gaps are rarely dramatic. They are usually evidence gaps.
- Backups running, but no recent restore test evidence.
- Microsoft 365 data assumed to be protected by Microsoft alone.
- Training completed by some staff, but not consistently recorded.
- Supply staff and governors overlooked in training evidence.
- Police CyberAlarm registration unclear or undocumented.
- Incident response plans written for general emergencies, not cyber incidents.
- SLT unsure what happens if email, MIS or shared drives are unavailable.
- Backup responsibilities split between the school and IT provider.
- No simple evidence pack for governors, trustees or RPA queries.
- RPA conditions only reviewed after a near miss or renewal conversation.
In simple terms: check → fix → evidence → review.
Check
We review backups, training evidence, Police CyberAlarm registration, incident plans and related school cyber controls.
Fix
We help close practical gaps around backup protection, restore testing, awareness, account security and response planning.
Evidence
We help turn activity into clear evidence that SLT, governors, trustees and insurers can understand.
Review
We help keep RPA-related cyber controls under review, rather than treating them as a one-off job.
Services that support the conditions behind the cover.
NCSC Cyber Security Training for School Staff
Understand recommended training approaches for schools and how to evidence awareness properly.
Training platformHuntress Security Awareness Training
Short, practical cyber training with reporting and tracking to support RPA evidence.
Training & Phishing simulationGoldphish
Modern security training and phishing simulations - designed to keep training engaging and measurable.
Training platformCyberSmart Learn
Structured cyber awareness training aligned to compliance and certification requirements.
BackupsCloud Backup for Schools
Protect servers and Microsoft 365 data with backup designed around recovery and evidence.
Microsoft 365Microsoft 365 Backup
Recover email, Teams, OneDrive and SharePoint data if something is deleted or compromised.
RecoveryAxcient Backup
Backup and recovery for school servers, endpoints and critical systems.
DfE standardsDfE Cyber Standards Support
Map your school’s controls against DfE expectations and identify gaps.
Wider protectionCyber Security for Schools
See how email, identity, endpoint, backup and training controls work together.
This is guidance, not insurance advice.
This page provides general guidance to help schools understand and prepare for RPA cyber cover conditions. It should not be taken as legal or insurance advice. Black Swan Cyber Security Solutions is not affiliated with the DfE or the RPA, and each claim is assessed by the relevant RPA process.
Questions schools often ask about RPA cyber cover.
What are the RPA cyber cover conditions?
Schools are commonly expected to evidence offline or protected backups, cyber security training, Police CyberAlarm registration and a cyber response plan.
Does Microsoft 365 automatically cover our school email and files?
No. Microsoft provides the platform, but schools are still responsible for protecting and recovering their own data. Separate Microsoft 365 backup is usually worth considering.
How often should schools test backups?
Schools should test restores regularly and keep evidence. The DfE cyber security standard expects backup arrangements to be reviewed and tested, not just assumed.
Do governors need cyber security training?
If governors have access to school IT systems, training evidence may be needed. Governors also benefit from cyber awareness so they can provide better oversight.
Can you work with our existing IT provider?
Yes. We can work alongside your IT provider to review the RPA-related controls, identify gaps and create clearer evidence.
Can you confirm whether a claim would be accepted?
No. We cannot confirm whether a specific claim would be accepted. We can help you understand the cyber conditions, improve controls and prepare evidence.
Find the gaps before an incident exposes them.
If your school is relying on RPA cyber cover, it is worth checking now whether your backups, training, Police CyberAlarm registration and response plan are properly evidenced.
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.