Schools and academy trusts under the Cyber Security and Resilience Bill
Most schools and academy trusts are unlikely to be directly regulated by the Cyber Security and Resilience Bill (CSRB), because education is not an essential service under it. The effects will mostly arrive through regulated IT suppliers, while Department for Education cyber standards already apply separately.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Why schools are mostly outside
The Cyber Security and Resilience Bill (CSRB) regulates listed essential services, certain digital services, managed service providers and designated suppliers. Schedule 2 of the NIS Regulations 2018 has no education subsector, and the Bill does not add one.
Other exclusions may help. The RDSP and RMSP definitions exclude micro and small enterprises, and organisations under public authority oversight unless they earn more than half of their income commercially. The government also says it intends to exclude public sector bodies from critical supplier designation, subject to consultation.
The Bill's text does not mention schools or academy trusts. How each exclusion applies to a particular trust is not settled, so treat these as general pointers.
Three situations to check
| Situation | Likely position | What to do |
|---|---|---|
| School or trust using outside IT suppliers | Not directly regulated; supplier may be | Update contracts and contacts |
| Trust running IT for its own schools | Unlikely on its own to be an RMSP, but not addressed by the Bill | Record how IT is delivered |
| Trust or school company selling IT services to others | Could be an RMSP if the definition and size tests are met | Take advice, including on oversight and income |
Supplier effects
Your edtech vendors and managed IT provider may be regulated, depending on what they do and their size. A regulated provider must notify affected UK customers after giving the regulator its full notification.
Trusts should keep a central view of supplier access across schools, rather than leaving each school to hold its own list. Check who gets the notice, because it may otherwise go to an office mailbox during the holidays.
The standards you already have
DfE's cyber security standards are the practical baseline. As updated in September 2026, they include:
- An annual risk assessment, reviewed each term or after significant change.
- Multi-factor authentication for staff cloud or remote access and for IT admin accounts.
- Fixes for critical or high-risk vulnerabilities within 14 days.
- Three backup copies on two devices with one offsite, made immutable and tested termly.
- Annual training for staff, students and at least one governor or trustee.
Responsibility is shared. A senior leadership digital lead is accountable, IT support does the work, and governors or trustees provide oversight. See the DfE page for the current wording.
What to do
- Confirm no trust company sells managed IT or cloud services to outside customers.
- Build one supplier list across all schools.
- Add incident notice contacts to supplier contracts.
- Check your position against the DfE standards.
- Ask governors or trustees to review the supplier list and incident plan each year, and make sure at least one of them has completed the training.
Sources
Frequently asked questions
Education is not listed as an essential service, so most schools will not be directly regulated. A school or trust could only be caught through a separate route, such as selling managed IT services, and public authority oversight rules may then be relevant.
Providing IT centrally to its own schools does not automatically make a trust an RMSP. The position could differ if it sells ongoing IT management to others under contract. The Bill’s text does not address trusts specifically, so take advice on the facts.
DfE presents them as its recommended approach to meeting the duty in Keeping children safe in education. Some items are firmer: Cyber Essentials is a funding agreement requirement for colleges, and certain actions are conditions of Risk Protection Arrangement cover.
DfE lists your insurer or RPA, Report Fraud and the DfE sector cyber team. Report high-risk personal data breaches to the ICO within 72 hours. Check the current DfE page, as guidance is updated.