Section 2 and 3: Your network, systems and insurance
Choose Whole Organisation unless you have a clear reason to leave part of your network out.
IASME advises certifying the whole school network. This the most protection and qualifies you for the included cyber insurance (funding under £20 million). If you exclude part of your network, you lose the insurance.
You can leave out a pupil or guest network that is segregated on its own and cannot reach school data. This is the only exception: you can leave it out and still choose Whole Organisation. No other network can be left out.
Staff devices and cloud services can never be left out.
If several schools share the same network, one assessment must cover them all.
Complete this if you chose Partial in 2.1; otherwise enter Whole organisation in scope.
Describe which networks are covered. Use the same network names you give in question 2.4.
Do not include IP addresses or technical detail.
Partial scope
For a partial scope, your certificate will show "Partial Organisation, see certificate platform for details." Your full description will appear on the certificate platform.
2.2.1 Please provide a description of any networks excluded from the assessment.
List any network you have left out.
Partial
If you chose Partial, list each excluded network and what it is used for. This information is not made public.
Whole organisation
If you chose Whole Organisation, you can only list a segregated pupil or guest network that cannot reach school data. Otherwise enter No networks excluded - whole organisation in scope.
2.2.2 Where sub-sets have been created, please describe how this has been achieved.
Describe how you keep each excluded network separate. Only a firewall or VLAN counts. Security groups, micro-segmentation and software-based methods do not count.
A pupil or guest network must be:
- on its own network
- unable to interact with your school data or services
If nothing is excluded, enter No sub-sets created - whole organisation in scope.
Single-site schools
Answer Yes if all in-scope networks are at the location listed in 1.5.1.
Trusts
If the same network is also used at sites not listed in 1.5.1:
- answer No
- give the number and names of the extra sites
Home workers are not counted as sites. If several schools share the same network, one assessment must cover them all.
2.3.1 Do you have an internet connection for each site in your organisation?
Answer:
- Yes if every site connects to the internet directly
- No if some sites only reach the internet through another site, for example over a private link to a Trust head office
2.3.2 If no, please describe how your sites are connected.
Describe how your sites connect to each other and to the internet (for example, a private link from each school to the Trust head office, or a leased line). If every site has its own internet connection, say so.
List each network in scope with its name, location and purpose.
Do not include:
- IP addresses
- technical settings such as VLAN numbers
- development, testing or penetration testing networks - these must be separated by a firewall or VLAN and left out
If you have a segregated pupil or guest WiFi network that you are leaving out, put that information in 2.2.1, not here.
Home and remote workers are covered in 2.4.1 and 2.4.2.
2.4.1 How many staff are home or remote workers?
A home worker is anyone who accesses school data or services from home, even occasionally (for example, a teacher using school email at home).
Pupils using a segregated pupil network are not included. Their devices are in scope whether the school or the person owns them.
Say if nobody works remotely.
2.4.2 How are home or remote workers connecting to organisational data and services?
Describe how remote staff reach school data (for example, Microsoft 365 or Google Workspace from a home router, or a school VPN).
A staff member's own home router is out of scope unless the school supplied it, but software firewalls on their devices must be on.
If a home worker uses a corporate VPN, their internet boundary is the school's firewall (NCSC Requirements v3.3, page 9).
Say if nobody works remotely.
List the routers and firewalls that control traffic between your network and the internet. Include:
- make
- model
- quantity
Do not include:
- IP addresses
- MAC addresses or serial numbers
- home routers
If your broadband provider or IT company manages your firewall, list it and ask them for the make and model.
You do not need switches or wireless access points unless they contain a firewall or route internet traffic.
Firewall firmware is treated as an operating system and must be in vendor support (see 6.1).
Mention any remote workers who rely on software firewalls on their devices.
2.5.1 If partial organisation, please list equipment used to create sub-sets.
Only complete this if you chose Partial or have left out a segregated pupil or guest network; otherwise enter No sub-sets created - whole organisation in scope.
List the routers, physical firewalls or virtual firewalls (hosted on a hypervisor) that separate the excluded networks.
Windows Firewall and other software firewalls built into devices cannot be used to define your scope.
List every laptop, desktop and virtual desktop that can reach school data or services. That includes:
- school-owned devices used by pupils
- computers connected to interactive whiteboards
- staff or governors' own laptops if they use them for school email or files (BYOD).
NCSC is clear that it is not acceptable to exclude end-user devices from your scope (Requirements v3.3, page 7).
Give the make and operating system. For Windows, also give the edition and version (for example Windows 11 Education 25H2). Windows 10 is only acceptable with Microsoft Extended Security Updates in place.
Pupils' own devices are out of scope if they only use a segregated pupil or guest wifi that cannot reach school data.
List school-owned devices loaned to pupils (NCSC Requirements v3.3, pages 11 to 12).
2.6.1 Please list thin clients in scope (make and OS).
NCSC describes thin clients as simplified computers with a minimal operating system, mainly used to reach virtual desktops. They must be supported and receive regular security updates.
List any thin clients that can reach school data or services. Include the make and operating system.
If you have none, say so.
NCSC defines servers as devices that provide organisational data or services to other devices (Requirements v3.3, page 5). List every server, virtual server and hypervisor.
Include on-site servers that hold or serve school data for your:
- MIS
- file storage
- Print access
- door access
- CCTV
Give the operating system and version (for example Windows Server 2022). Hypervisors must also be in vendor support.
If you use virtual desktops, list the devices used to access them in 2.6.
If you have no servers because everything is in cloud services, say so and list those services in 2.9.
List all:
- school-owned tablets and phones used by pupils (including iPads
- personal phones or tablets that staff or governors use for school email or files
Include the make and operating system. You do not need to add models.
NCSC says personal devices that access school data are in scope. If a phone is only used for calls, texts or authenticator apps it is out of scope (Requirements v3.3, page 8). If a teacher reads school email on their own phone, that phone is in scope and must be listed. A personal device on a segregated guest WiFi that cannot reach school data is out of scope.
Smart devices (such as CCTV cameras and thermostats) are not part of Cyber Essentials.
Cloud services cannot be left out of scope (NCSC Requirements v3.3, page 7). List every cloud service with a login that stores or processes school data, including school social media accounts.
You are always responsible for making sure the five controls are applied, but who does the work depends on the type of service (NCSC Requirements v3.3, Table 1, page 10).
Software as a Service (SaaS)
This includes, for example, Microsoft 365, Google Workspace, Dropbox). The provider handles firewalls, updates and malware protection. You share secure configuration and you always control user access, including MFA.
Platform as a Service (PaaS)
This includes, for example, Azure Web Apps). The provider mostly handles firewalls and malware protection. You share secure configuration and updates with the provider. You control user access.
Infrastructure as a Service (IaaS)
This includes, for example, Amazon EC2, and Google Compute Engine.
You and the provider share:
- firewalls
- secure configuration
- updates
- malware protection
You control user access. Where the provider does a control for you, check its contract or security statement confirms it (NCSC Requirements v3.3, page 11).
Give the name and job title of the person responsible for managing your IT systems. They must be a member of your school or Trust and cannot be employed by your IT support provider.
If you have no in-house IT, name the senior leader or business manager who oversees your IT support provider.
This question is added by this questionnaire and is not an IASME question.
If an outside company manages your IT, responsibility for the controls still lies with the school. You must be able to show you understand what controls are in place and that they meet Cyber Essentials. IASME says the easiest evidence is a contract with the provider that includes the Cyber Essentials controls. NCSC says the same for externally managed services and third-party accounts (Requirements v3.3, page 11).
Answer Yes if:
- your head office is in the UK or Crown Dependencies, and
- you have an annual turnover of less than £20 million
Answer Yes if you:
- answered Yes to 3.1, and
- want to opt in to the insurance
Add the email contact for the best person to receive insurance documents.
Did you find what you needed?
Fill in our 3 question survey and let us know if you need more help.