Cyber Essentials and Microsoft 365 for education suppliers, schools and colleges
Colleges must hold Cyber Essentials, schools are told to ask their IT suppliers for it, and the DfE standard sets the bar.
The rules, and where they come from
Further education colleges in England must hold Cyber Essentials under their funding agreement. Schools do not have to certify, but the Department for Education wants every school and college working towards its cyber security standard by 2030. It also suggests schools ask their outsourced IT support whether they hold Cyber Essentials or Plus. So the rules reach three groups: colleges, schools, and the companies that supply them.
| What | Status | Who | Source |
|---|---|---|---|
| Cyber Essentials | Required under the funding agreement | Colleges and special post-16 institutions in England, from the 2024 to 2025 funding year | DfE cyber security standard; ESFA update, 24 July 2024 |
| Cyber Essentials | Optional. "Some schools may wish to complete it" | Schools | DfE cyber security standard |
| Work towards 6 core digital standards, including cyber security, by 2030 | Expected ("should") | All schools and colleges in England | DfE digital and technology standards |
| MFA on staff accounts with access to cloud services or remote access, and on IT admin accounts | "Must" in the DfE standard | Schools and colleges using the standard | DfE cyber security standard |
| Ask outsourced IT support whether they hold Cyber Essentials or Plus | Suggested to schools | IT suppliers to schools and colleges | DfE cyber security standard |
Attacks on education are frequent. In the government's 2025/2026 survey, 73% of secondary schools, 88% of further education colleges and 49% of primary schools identified a breach or attack in the last 12 months, with phishing the main threat (DSIT education findings, 30 April 2026). Patching is the weak spot: a 14-day update policy was the Cyber Essentials area the fewest education institutions covered. Under the Cyber Essentials requirements, school-owned devices used by students are in scope and students' own devices are out of scope. Staff, volunteers and trustees using their own devices for school data are in scope (NCSC requirements v3.3).
How we deliver it
For education suppliers, such as software, training and consultancy firms, our support plans and Cyber Essentials packages are a straight fit. We prepare you and support the submission, so you have an answer when a school asks. The certification body makes the decision. Cyber Essentials is £995 a year for 10 to 19 people on Managed or Secure, or £1,295 without a plan; every band is on the Cyber Essentials page.
Schools and colleges: you can keep your Microsoft 365 Education licences where they are. They are not on our price list and we do not need to supply them. On Managed or Secure we keep MFA and security settings in place and back up Microsoft 365, two things the DfE standard asks for. We can prepare you for Cyber Essentials, which colleges need and schools may choose; the certification body makes the decision. The £395 Microsoft 365 audit for up to 25 users is a read-only first step. Our Managed plan covers up to 2 computers per user, so classroom device sets, on-site visits or more than 50 people get a bespoke quote.
Example at our prices
Example only, not a quote
A 12-person company selling software to schools, on Microsoft 365 Business Premium and our Managed plan, certifying to Cyber Essentials.
- Licences: 12 × £24.60 = £295.20 a month
- Managed support: 12 × £35 = £420 a month, above the £250 monthly minimum
- Together: £295.20 + £420 = £715.20 a month, or £8,582.40 a year
- Cyber Essentials, support-client price for 10 to 19 people: £995 a year
- Year one: £8,582.40 + £995 = £9,577.40, excluding VAT
Common questions
Do schools have to get Cyber Essentials?
No. The DfE says it is a requirement for colleges under their funding agreement, and that some schools may wish to complete it. All schools and colleges should be working towards the DfE's cyber security standard by 2030.
Will a school ask its IT supplier for Cyber Essentials?
The DfE standard suggests schools ask their outsourced IT support whether they hold Cyber Essentials or Cyber Essentials Plus, so a supplier to schools should expect the question.
Can you supply Microsoft 365 Education licences?
They are not on our price list. You can keep your licences where they are and we support and secure the tenant.