IT Support for Schools and CollegesIT support for schools and colleges that meets the DfE standards, not just the helpdesk.
Schools and colleges now have published DfE standards for cyber security, backups and filtering and monitoring, governors who are expected to ask about them, and in many cases insurance or funding that depends on them. We support schools and colleges: education licensing supplied, devices and accounts secured, backups that meet the DfE's rules, and help through Cyber Essentials. We recently took a college through Cyber Essentials, supplying its licences, backups and an IT health check along the way.
Who this is for
Primary and secondary schools, academies, multi-academy trusts, independent schools and further education colleges, usually with a business manager or network manager who needs more hands, and a senior leader who is accountable for the DfE standards.
The DfE cyber security standards, in plain terms
The Department for Education publishes cyber security standards for schools and colleges. They ask for an annual cyber risk assessment reviewed every term, cyber awareness training at least once a year, firewalls and centrally managed anti-malware, unique accounts with multi-factor authentication for staff with cloud or remote access and for IT admin accounts, licensed and supported software with critical security updates applied within 14 days, a backup plan reviewed every year, and a clear route for reporting an attack.
Those are the controls we put in as standard. We work with your senior digital lead on the risk assessment, keep the evidence as we go, and give governors a short report each term on where you stand against each standard.
Source: Cyber security standards for schools and colleges (DfE)
Backups that meet the DfE rule
The DfE standard is specific: at least three backup copies of important data on at least two separate devices, at least one copy off site, immutable backups that cannot be altered or deleted, and restores tested every term. A backup drive in the server room does not meet it, and a ransomware attack is exactly when that becomes obvious.
We supply and run backups that do: Microsoft 365 or Google Workspace backed up outside the vendor, any on-site server backed up off site and immutably, kept in the UK, with a restore tested each term and the result recorded for your evidence.
Cyber Essentials, and why colleges need it
The DfE's standards state that Cyber Essentials is a requirement for colleges under their funding agreement. Schools are not required to hold it, but the controls are the same ones the DfE standards ask for, so certification is a practical way to prove the standards are met.
We take schools and colleges through it from a standing start: a gap assessment against the requirements, the fixes, the questionnaire and the evidence. We recently did exactly this for a college, supplying the licences and backups it needed and running an IT health check first so the gaps were known before the work began.
Source: Cyber security standards for schools and colleges (DfE)
Risk protection arrangement (RPA) cyber cover
For schools in the DfE's risk protection arrangement, cyber cover comes with conditions, including offline backups, NCSC cyber security training for staff, registration with Police CyberAlarm and a cyber response plan. We help you meet and evidence each of them, so a claim is not refused on a technicality at the worst possible moment.
Source: Risk protection arrangement (DfE Cyber Security Hub)
Filtering and monitoring
Keeping Children Safe in Education and the DfE's filtering and monitoring standards split the work: senior leaders and the designated safeguarding lead own the decisions and respond to what monitoring finds, and the IT service provider has technical responsibility for keeping the systems working, on site and off site, and for the annual review alongside them.
Some schools take filtering and monitoring from us; others already have it through their broadband supplier or local authority. Either way we take the technical side: making sure it covers every device and the guest and staff networks, testing that it blocks what it should, and joining the annual review with your DSL and governor.
Source: Filtering and monitoring standards for schools and colleges (DfE)
Microsoft 365 Education or Google Workspace for Education
Microsoft licenses schools and colleges on its education plans, A1, A3 and A5, which are not the same as the business plans: A3 adds the desktop apps, device management and security, and A5 the advanced security and analytics. Google Workspace for Education Fundamentals is available at no charge for qualifying institutions, with Education Plus as the paid edition. We supply the licences, make sure staff and pupils are on the right ones, and switch on the security that comes with them.
Pupil and staff accounts are kept separate, MFA is enforced for staff, and laptops, tablets and Chromebooks are managed through Intune or Google's device management, so a lost device can be locked and wiped and a new one is ready for a pupil without a technician touching it.
Source: Microsoft 365 Education (Microsoft UK), Compare Google Workspace for Education editions (Google)
What is included
Where schools and colleges get hit. What stops it.
Ransomware takes out the network and the only backup was on it
Three copies, one off site and immutable, restores tested every term
A staff account without MFA opens the door to pupil data
MFA on every staff and admin account, leavers removed the same day
Governors ask for evidence of the DfE standards and nobody has it
Annual risk assessment and a plain-English report for governors
Helpdesk and monitoring
Support answered by an engineer in office hours (Monday to Thursday 08:45 to 17:00, Friday to 16:00), every device monitored and patched, with critical security updates applied inside the DfE's 14 days.
Education licensing supplied
Microsoft 365 Education or Google Workspace for Education supplied, staff and pupils on the right plans, and licences reviewed each year so you are not paying for leavers.
Accounts and devices
Staff and pupil accounts separated, MFA on every staff and admin account, leavers removed the same day, and laptops, tablets and Chromebooks managed and wipeable.
Backup to the DfE standard
Three copies on two devices, one off site and immutable, Microsoft 365 or Google Workspace backed up outside the vendor, kept in the UK, restores tested every term.
Cyber Essentials
Gap assessment, the fixes and the questionnaire, taken through to certification, with the evidence colleges need for their funding agreement.
Filtering and monitoring
Provided by us, or the provider you already have kept working on every device, tested, and reviewed each year with your DSL.
Governor reporting
An annual cyber risk assessment, a termly plain-English summary against the DfE standards, and an IT health check to start from.
What is not included, and why
- MIS and learning platforms such as SIMS, Arbor, Bromcom or Google Classroom are the vendor's to support. We protect the accounts behind them and handle the sign-in integrations.
- Safeguarding decisions. Your DSL owns those; we make sure the systems behind them work and show them what they need to see.
- Broadband, Wi-Fi and phones are separate services, covered on the connectivity, networking and VoIP pages.
What it costs
Managed IT support for schools and colleges is priced per user per month, with security monitoring and device management included, so it moves with your staff numbers. Backup is a separate service, and education licences are supplied at Microsoft's or Google's education prices. Onboarding, Cyber Essentials and any infrastructure work are quoted as fixed projects. We quote after a short discovery call, once we know your setup.
How it starts
- 1Free IT Health CheckA short online check that benchmarks your security and business risk and tells you where you stand.
- 2Discovery callAn engineer, not a salesperson. What you have, what is broken, what it would cost to fix, in writing.
- 3OnboardingEverything moves across on a plan, with no gap in cover and nothing lost.
Free, no sales call needed
Two free checks. Know where you stand.
Domain email check
Can someone send email pretending to be you? Is your real email landing in junk? Type your domain and find out in under a minute.
IT Health Check
A short set of questions that scores your security and business risk, and tells you what to fix first. 15 to 20 minutes on your own.
Questions people ask before signing
Do you already support schools?
Yes. We support schools and recently took a college through Cyber Essentials, supplying its licences and backups and running an IT health check first. We do not name education customers on the website, but we are happy to talk through what we did on a call.
Is Cyber Essentials compulsory for schools?
Not for schools. The DfE's cyber security standards say it is a requirement for colleges under their funding agreement. For schools it is optional, but the controls overlap with the DfE standards, so it is a practical way to show governors and insurers the standards are met.
What does the DfE expect from our backups?
At least three copies of important data on at least two separate devices, one copy off site, backups that are immutable, and restores tested every term, with the plan reviewed every year. If you are in the risk protection arrangement, cyber cover also needs offline backups. We set this up and record each test for your evidence.
Do you provide web filtering and monitoring?
We can, or we can work with the filtering and monitoring you already have through your broadband supplier or local authority. Either way we take the technical responsibility the DfE standards give the IT provider: keeping it working on every device, testing it, and joining your annual review with the DSL.
We use Google Workspace and Chromebooks. Can you support us?
Yes. We support Google Workspace for Education and Microsoft 365 Education equally. Chromebooks are managed through Google's admin console, staff accounts get 2-Step Verification, and Gmail and Drive are backed up outside Google.
Can you report to our governors?
Yes. We help your senior digital lead with the annual cyber risk assessment the DfE asks for, and produce a short termly summary against each standard that a governor can read in ten minutes.
How much does IT support cost for a school?
Managed support is priced per user per month with security included. What changes the figure is the number of staff and devices, any servers, and whether you need us on site. Backup is separate, licences are at education prices, and projects such as Cyber Essentials are quoted as fixed pieces of work. We quote after a short discovery call.