Cyber Essentials for UK education providers Certified by Fig.
Fig Group certifies UK education providers - independent schools, colleges, universities, training providers, edtech SaaS. IASME-licensed, from £299.99 + VAT, with MSP-friendly multi-tenant workflow for federations and MATs.
Sector-specific
Tailored to education providers
The standard scheme guidance does not address the operational reality of this sector. These are the scope, regulatory, and supplier-cascade points Fig assessors check first.
- 01DfE cybersecurity standards for schools.
- 02MIS (Arbor, Bromcom, SIMS) and safeguarding-adjacent data.
- 03Multi-academy trust (MAT) federated certification.
- 04University research computing scope exclusion pattern.
- 05Pupil / student estate scope exclusion.
- 06Edtech SaaS corporate-only scoping.
Pricing at a glance
Below the standard IASME fee at every tier
No re-submission charges. Three free re-submissions included. Published pricing - no gated forms or consultancy add-ons.
Turnaround
6 hours
For compliant submissions before midday.
Cyber Essentials
£299.99 – £549.99
+ VAT, by organisation size.
Cyber Essentials Plus
£1,499 – £4,499
+ VAT, third-party verified.
Common questions
Frequently asked questions
Does the DfE require Cyber Essentials for schools?
The DfE Cyber Security Standards recommend CE/CE Plus. Some grant-funded programmes and MAT funding agreements require it. Check your specific funding condition.
How do MATs handle CE across multiple academies?
Typically by certifying the central MAT IT infrastructure and flowing evidence to each academy, or by certifying each academy separately for granular scope. Fig supports both patterns on the multi-tenant platform.
Is pupil/student estate in scope?
Pupil devices are typically out of scope unless they access staff/corporate data. The scope description needs to be explicit about this - a policy-only exclusion does not work under v3.3.
What about university research computing?
Research compute clusters are typically excluded from scope and governed under separate IT security regimes. Declare the exclusion in the scope statement and evidence the technical boundary.
What is the pricing for a 500-student independent school?
Scope typically covers teaching and admin staff plus MIS - roughly 50–100 staff accounts. CE Small (10–49) at £399.99 + VAT or CE Medium (50–249) at £449.99 + VAT depending on total staff count.
Deep-dive articles
Long-form guidance for education providers
Technical guidance written by an IASME-licensed assessor - scope edge cases, supplier cascade, and regulatory overlap that the scheme guidance does not cover.
Next step
Ready to certify?
From £299.99 + VAT. IASME-licensed. Typically within 6 working hours. No consultancy add-ons.