#EdTech: Case Study Multi Academy Trust - Cyber Essentials Certification

Getting a 7-School Trust Through Cyber Essentials

The Client is a multi-academy trust managing 7 primary schools across Staffordshire & Cheshire, with over 1,500 pupils and about 250 staff.

The Challenge: Like many trusts that have grown through acquisition, they'd inherited different systems and security practices across their schools. When Cyber Essentials became a requirement for specific funding, they knew they needed to get certified—but had no clear picture of where they stood or what it would take.

The Situation: Our initial assessment across all 7 sites revealed:

• Three schools running unsupported Windows versions

• Inconsistent password policies and user access controls

• Ad-hoc approach to software patching

• BYOD policies that hadn't been adequately thought through

• User accounts that hadn't been reviewed in years

They weren't in terrible shape, but they weren't ready for certification either.

Our Approach

We started with a full audit, then built a realistic budget and timeline. The Trust had expected significant hardware costs, but most issues could be resolved through better processes and targeted upgrades. The actual spend was considerably less than anticipated.

We project-managed the implementation across all 7 schools:

• Scheduled major upgrades during school holidays to avoid disruption

• Worked through policy updates and more minor fixes during term time

• Appointed and trained a cyber champion in each school—office managers, caretakers, teaching staff—to maintain standards

• Provided regular, jargon-free progress reports to governors

The work was spread over 6 months to keep it manageable.

The Results

The Trust (including all 7 schools) achieved certification. Beyond the certificate itself, the Trust gained:

Better Security Proper password management, automatic patching, and straightforward access controls replaced the previous ad-hoc approach. They're now protected against the most common school-targeted attacks.

Stakeholder Confidence: The Trust can demonstrate to governors, parents, and regulators that it has independently verified its security practices. This matters when you're responsible for thousands of children's data.

Access to Funding Several contracts and funding streams require Cyber Essentials as a baseline. The Trust can now pursue opportunities that were previously unavailable.

Improved Culture Staff understand the reasoning behind security policies. The cyber champion network means each school has someone who can answer questions and maintain standards without everything going through central IT.

Client Feedback: "We can actually answer questions from governors now with confidence. Before, it was vague reassurances; now we can point to independent certification and explain exactly what we've done. Text Shepherd handled the complexity so we didn't have to become cybersecurity experts—they just got us through it." — Director of Operations

Summary: Cyber Essentials certification is achievable for multi-academy trusts with proper assessment, realistic planning, and experienced project management. The process doesn't have to disrupt schools, and the benefits extend well beyond compliance.

Want to discuss your Trust's Cyber Essentials journey? Get in touch.