What we assess, and what is in scope
Cyber Readiness assesses your posture across recognised security domains and frames the findings against National Cyber Security Centre (NCSC), Cyber Essentials and the Department for Education (DfE) Cyber Security Standards. Clear scope boundaries mean you know exactly what the assessment includes and what it does not.
Assessed across recognised domains
The report covers the areas that determine whether a school can prevent, withstand and recover from a cyber incident:
- Physical security
- Infrastructure and network configuration
- Governance and risk management
- Operational security controls
- Cyber security planning
- Vulnerability management
Measured against the standards that matter
Findings are framed against NCSC guidance, Cyber Essentials principles and the DfE Cyber Security Standards. You receive an overall maturity position, for example Developing, so progress can be measured over time and evidenced to governors, trustees and the Risk Protection Arrangement.
Cyber Essentials and Cyber Essentials Plus follow as outcomes of the work rather than as the starting point.
What is included, and what is not
Clear boundaries protect both the quality of the assessment and your expectation of what it is.
In scope
- Guided pre-assessment fact-find, with self-assessment and human validation
- A free Cyber Readiness Self-Assessment is available as a high-level starting point
- Automated internal and external network penetration testing: a sweep of up to 500 IP addresses per test as standard, scoped across a representative selection of your core technology sets
- Technical findings report and plain-English executive summary
- Prioritised improvement plan mapped to recognised good practice and the DfE standards
- A closing review meeting to present findings and agree next steps
Available separately, not in the standard assessment
- Remediation of identified issues, delivered through our managed services and infrastructure capability
- Manual CREST-accredited penetration testing, where a school specifically requires it, as our assessment is automated and tooling-led
- Formal certification such as Cyber Essentials or Cyber Essentials Plus, which the assessment can inform but does not itself award
- Ongoing managed detection or monitoring, as this is a point-in-time assessment
- Staff awareness training, phishing simulation and policy authoring as standalone deliverables, though the assessment identifies where they are needed
Assumptions and dependencies
To run the assessment cleanly, we rely on a small number of things from you: timely access to the environment, network information and the staff who can answer the pre-assessment questions; completion of the self-assessment before the technical stage; and testing scoped and scheduled with the right permissions in place before any test is run.
Reports and outputs contain no pupil data, staff personal data or network credentials.
Book a Cyber Readiness assessment
Tell us about your school or trust and we will confirm the scope for your network.