Multi-Academy Trusts are already familiar with cyber security guidance.
There are DfE standards, safeguarding duties, data protection requirements, insurance questions, audit recommendations and, in some cases, Cyber Essentials assessments.
So it would be understandable if the arrival of another framework produced more groans than excitement.
However, the National Cyber Security Centre’s Cyber Assessment Framework, better known as the CAF, may be worth a closer look, particularly for larger trusts.
It was not written specifically for education, and there is currently no published requirement for MATs to complete a formal CAF assessment.
Even so, the framework asks the sort of questions that become increasingly important as a trust grows.
Does the organisation properly understand its cyber risks?
Are important systems protected consistently across every site?
Would suspicious activity be detected quickly?
Could the trust continue operating if a major system failed?
And, perhaps most importantly, could senior leaders and trustees demonstrate that they know the answers?
For a trust supporting dozens of academies, thousands of users and a growing collection of cloud systems, those are no longer questions for the IT department alone.
What is the Cyber Assessment Framework?
The NCSC Cyber Assessment Framework was originally developed to help organisations responsible for essential services assess their cyber resilience.
It is used in sectors where a major disruption could have serious consequences, including energy, transport, health, digital infrastructure and government.
Schools do not currently sit within that formal scope, but the framework itself is broader than any one industry. It looks at how an organisation manages risk, protects its systems, spots attacks and recovers when something goes wrong.
The current CAF is built around four objectives:
Managing security risk.
Protecting against cyber attack.
Detecting cyber security events.
Minimising the impact of incidents.
Those headings may sound fairly obvious, but the value lies in what sits beneath them.
CAF is not a list of products to buy. It does not say that installing a particular firewall, antivirus package or backup platform makes an organisation secure.
Instead, it asks whether the organisation is achieving the right outcomes.
That is a subtle but important difference.
A policy may say that multi-factor authentication must be used. The CAF approach asks whether it is actually being used everywhere it should be, whether exceptions are known and whether anyone checks that the control is still working.
A backup dashboard may show green ticks every morning. The framework asks whether the organisation could restore its most important systems, in the right order, within an acceptable period.
That is a much more useful conversation.
Why larger MATs may find CAF relevant
A small standalone school and a large Multi-Academy Trust may use similar technology, but they do not carry the same level of organisational risk.
A larger trust may have thousands of staff and pupil accounts, multiple finance and HR systems, centralised safeguarding platforms, different network designs and equipment inherited from academies that joined at different times.
Some services will be managed centrally. Others may still depend on local arrangements, historic suppliers or systems that nobody would choose if they were starting again today.
The trust may also depend heavily on outside providers.
That could include its management information system, filtering provider, broadband supplier, payroll platform, outsourced IT company, cloud backup service, safeguarding software and numerous curriculum applications.
The more connected the trust becomes, the more difficult it is to judge risk by looking at one school, one server or one security product.
A compromised account in one academy may give an attacker access to systems used across the entire organisation.
A problem with a central identity platform could affect every school at once.
A ransomware incident could disrupt payroll, safeguarding, communications and classroom systems across several counties.
At that point, saying “we have antivirus” is not really an answer.
Trustees need to know what the trust depends on, where the biggest weaknesses are and how quickly the organisation would spot and contain a problem.
The CAF provides a structure for asking those questions.
It starts with knowing what matters
The first part of the CAF is about managing security risk.
For a MAT, this should begin with identifying the services the trust genuinely cannot afford to lose.
That will usually include safeguarding records, management information systems, attendance, finance, payroll, email, parental communications, internet access and the identity systems used to control access to everything else.
It may also include telephony, door access, CCTV, filtering and monitoring, catering systems or specialist platforms used by individual academies.
Once those services have been identified, the trust needs to understand what supports them.
Which devices, accounts, suppliers and staff are involved?
Where is the data held?
Who has administrative access?
What happens if the supplier suffers an incident?
How quickly could the service be restored?
This is where the framework can expose some uncomfortable gaps.
A trust may know who supplies a system but not how that supplier manages privileged access.
It may have a contract with an IT provider but no clear agreement about who leads during a cyber attack.
It may assume that a cloud platform includes backup, only to discover that recovery options are limited.
It may also find that important systems have quietly become dependent on one person who understands how everything fits together.
None of these problems is unusual. The CAF simply makes them harder to ignore.
Policies are not the same as protection
The second CAF objective covers protection against cyber attack.
This includes familiar areas such as identity, access control, patching, network security, staff awareness and data protection.
Most MATs will recognise these subjects from the DfE cyber security standards for schools and colleges.
The difference is that CAF looks beyond whether a policy exists.
A trust may have a password policy, but are weak and breached passwords blocked?
It may require multi-factor authentication, but is that protection applied to administrators, senior leaders, remote access and sensitive systems?
Leavers may be removed from Microsoft 365, but what about the finance platform, safeguarding software, remote support tools and third-party applications?
Patching provides another good example.
The outcome is not achieved simply because the trust has bought a patch management product.
The trust needs to know what devices and software it owns, which vulnerabilities matter, how quickly important updates are installed and what happens when a system cannot be patched.
In a growing MAT, that consistency can be difficult to achieve.
One academy may be well managed. Another may have ageing devices, unusual software or a supplier that only visits once a month.
The CAF encourages leaders to stop asking whether the trust has a control and start asking whether the control works everywhere it is needed.
Would the trust know it had been attacked?
The third CAF objective is detection.
This may be the biggest change in thinking for some trusts.
School cyber security has traditionally focused heavily on prevention.
Install antivirus. Use a firewall. Train staff. Apply updates. Turn on multi-factor authentication.
All of that remains important, but attackers do not need every control to fail. They only need one route in.
That could be a stolen password, a malicious attachment, an unpatched application, a compromised supplier or a member of staff being persuaded to approve the wrong sign-in request.
The next question is therefore crucial.
Would the trust know?
Effective monitoring is not the same as collecting thousands of logs and never looking at them.
The trust needs visibility across the systems that matter, along with people who can recognise suspicious activity and respond quickly.
For a larger MAT, this might include endpoint activity, Microsoft 365 sign-ins, administrative changes, unusual mailbox rules, firewall events and access to important cloud systems.
It may also mean watching for activity outside normal working patterns, especially where attackers are trying to move from one account or academy to another.
Few trusts will want to build their own security operations centre. Nor would that necessarily be proportionate.
Managed services such as Huntress EDR, ITDR and SIEM can provide monitoring across endpoints, identities and security logs without requiring the trust to employ a full internal team.
However, the technology is only part of the answer.
Someone still needs to know who receives an alert, who has authority to isolate a device, who contacts the school and who takes control if the incident affects the wider trust.
An alert that sits unread until Monday morning is not much of a defence.
Recovery is more than having a backup
The final CAF objective looks at incident response and recovery.
This is where reassuring plans sometimes meet an awkward reality.
A trust may have an incident response document, but has it ever been tested?
Does it still contain the names of people who left two years ago?
Would leaders know what to do if email and Teams were unavailable?
Could safeguarding information still be accessed?
Would the trust contact its insurer before making changes to affected systems?
Who would speak to parents, staff, the DfE, the Information Commissioner’s Office or the police?
And who decides when it is safe to bring systems back online?
These questions are difficult to answer during an incident if nobody has considered them beforehand.
Backups are an important part of recovery, but a successful backup job is not proof that the trust could recover.
The trust needs to know what should be restored first, how long the process might take and whether the backup itself is protected from the same attack.
Independent cloud backup for schools and MATs can help protect important data, but it still needs to sit within a broader recovery plan.
A backup is a technical tool.
Recovery is the ability of the organisation to get back on its feet.
The two are not quite the same thing.
How CAF fits alongside the DfE standards
The CAF should not replace the DfE cyber security standards.
The DfE guidance remains the most relevant education-specific starting point for schools and colleges.
It covers many of the practical controls trusts should already be working towards, including asset management, multi-factor authentication, patching, backups, incident response and staff training.
The CAF looks at the same organisation from a slightly different height.
The DfE standards help a trust identify many of the controls it should have.
CAF helps leaders judge whether those controls work together to protect the services the trust relies on.
Cyber Essentials may also form part of that picture by providing independent assurance against a set of fundamental technical controls.
None of these frameworks needs to cancel out the others.
A larger trust may use the DfE standards to guide technical improvements, Cyber Essentials to test basic controls and the CAF to support wider governance, risk and resilience discussions.
Trustees will need evidence, not reassurance
Cyber security reporting to boards has sometimes been too technical at one extreme and too vague at the other.
Trustees may receive pages of firewall statistics that tell them very little about risk.
Alternatively, they may simply be told that systems are secure and backups are working.
Neither approach provides much assurance.
A CAF-style review should be supported by evidence.
That might include asset records, patching reports, administrator account reviews, multi-factor authentication coverage, backup test results, supplier assessments, staff training records and incident exercises.
It should also show where controls are incomplete.
That is not a sign of failure.
A trust with an honest list of known weaknesses and a sensible improvement plan is in a stronger position than one that claims everything is fine because nobody has looked too closely.
The purpose is not to produce paperwork for its own sake.
Good evidence helps leaders decide where limited money and staff time will have the greatest effect.
Where should a MAT begin?
A trust does not need to launch a huge CAF programme and attempt to answer every question at once.
That would risk turning a useful framework into another compliance burden.
A more sensible approach is to begin with the trust’s most important services.
What would cause the greatest harm if it became unavailable?
What could affect safeguarding, payroll, communications or the operation of several academies?
The trust can then map the systems, suppliers, identities and people that support those services.
Existing evidence from DfE standards work, Cyber Essentials, insurance reviews, data protection, business continuity and internal audits can be reused.
There is no benefit in creating a second filing cabinet full of almost identical documents.
The first assessment should also be honest.
Some outcomes may be achieved. Some may be partly achieved. Others may reveal a gap that nobody had previously spotted.
That is the point of doing the work.
The result should be a practical improvement plan with named owners, realistic priorities and progress that can be reported to trustees.
Is it accurate to say a trust is “CAF compliant”?
Probably not.
CAF is an assessment framework rather than a simple certification scheme.
There is no single certificate that allows every organisation to declare itself compliant.
Different sectors may use agreed profiles, assessment methods and levels of assurance. Schools and MATs do not currently have a formal education-sector CAF profile.
A trust should therefore be cautious about claiming CAF compliance.
It would be more accurate to say that it has carried out a CAF-aligned assessment, used the framework to review its cyber resilience or mapped its improvement plan against CAF outcomes.
That wording may be less exciting, but it is more honest.
Is this where MAT cyber security is heading?
It is impossible to say whether CAF will become a formal requirement for larger Multi-Academy Trusts.
There has been no announcement that this is about to happen, but the wider direction is fairly clear.
Trust boards are expected to understand risk, challenge senior leaders and seek proper assurance that the organisation is prepared.
As MATs become larger and more dependent on centralised technology, informal conversations and isolated technical reports will become less convincing.
The CAF gives trustees, senior leaders, IT teams and external providers a common language.
It allows them to discuss risk without pretending that a green dashboard or a newly purchased security product has solved everything.
Used sensibly, it should not become another mountain of documentation.
It should help the trust answer a much simpler question.
If an important system was attacked tomorrow, would we spot it, contain it and keep our schools running?
For larger Multi-Academy Trusts, that is a question worth asking before somebody else asks it for them.
