In short: Cyber security training for schools means annual awareness training for staff, governors or trustees and anyone else with a login, as the DfE cyber security standards expect. RPA members must also evidence that relevant users complete the NCSC's free training each year. A completion register, plus simulations, turns that into a year-round programme.
What the DfE cyber security standards expect
The DfE's cyber security standards for schools and colleges (part of its digital and technology standards, most recently updated in September 2026) set out seven areas:
- Conduct a cyber risk assessment annually and review it every term
- Create and implement a cyber awareness plan for students and staff
- Secure digital technology and data with anti-malware and a firewall
- Control and secure user accounts and access privileges
- License digital technology and keep it up to date
- Develop and implement a plan to back up your data, and review it every year
- Report cyber attacks
On training, the standard expects cyber security training for staff, at least one current governor or trustee, and anyone else with a login, such as supply or agency staff, at least once a year (or more often if there is a known risk). Supply teachers, agency workers and others with a login may need more focused training, delivered as soon as feasible. Data protection training is expected for all staff, with more frequent training for those who handle higher-risk data. Always check the current wording on GOV.UK, as the standards are updated regularly.
The RPA cyber cover training condition
The Risk Protection Arrangement (RPA) is the DfE's alternative to commercial insurance for academy trusts and eligible public sector schools. Its cyber cover comes with conditions, which include:
- Keeping offline backups
- Completing the NCSC's cyber security training
- Registering with Police CyberAlarm
- Having a cyber response plan
The training condition applies to staff and governors or trustees with access to the school's or trust's IT, and the DfE standards state that RPA members must be able to evidence that the relevant users have completed the free NCSC training, annually. If a condition is not met when an incident happens, cover may not apply, so the evidence matters as much as the training. Check the current RPA membership rules on GOV.UK for the exact wording that applies to your trust.
Keeping an evidence register
A simple completion register makes the annual training condition easy to prove. For each person with IT access, record:
| Field | Why it matters |
|---|---|
| Name and role (staff, governor, trustee, supply, volunteer) | Shows everyone in scope has been covered, not just teaching staff |
| Training completed (for example the NCSC training for school staff) | Shows which course satisfied the condition |
| Date completed and date due | Shows the training is annual and flags who is overdue |
| How it was evidenced (certificate, platform report, sign-in sheet for a group session) | Gives you something to produce if you make a claim |
| Any additional training (phishing simulation, data protection) | Shows a programme beyond the minimum |
Keep the register alongside your other cyber evidence: backup test results, the response plan review date and the Police CyberAlarm registration. Some schools deliver the NCSC training as a group session, for example on an INSET day, and record attendance; a training platform can then keep the register up to date automatically.
Going beyond the minimum
The NCSC training is a solid foundation, but a once-a-year session does not build habits on its own. School-specific risks worth covering through the year include:
- Phishing aimed at school business managers and finance staff, including fake supplier bank-detail changes; see business email compromise training
- Parent and pupil data handling, including sending reports and safeguarding information to the right recipient; see GDPR training for staff
- Shared classroom devices and logging out of interactive displays
- Account security for staff and governors, including MFA; see password and MFA training
- Age-appropriate awareness for pupils, as part of the cyber awareness plan
A platform that syncs with Microsoft 365 or Google Workspace for Education can assign short monthly lessons and termly phishing simulations automatically, and produce the completion report for governors.
Choosing a platform for a school or trust
For a multi-academy trust, look for central reporting across schools, user sync from your directory, short lessons that fit around a teaching timetable and a separate track for governors. Options from the vendors we supply include:
- usecure, with Microsoft 365 and Google Workspace user sync and automated enrolment
- Attack Simulation Training, if your Microsoft licences include Defender for Office 365 Plan 2
- HacWare or Breach Secure Now for very short, automated lessons
The free NCSC training remains the course to use for the RPA condition unless your RPA rules accept an equivalent, so we build the programme around it rather than replacing it. See also free security awareness training.
How we help schools and trusts
We set up the NCSC training as an annual assignment, keep the completion register for staff and governors, add simulations and short termly lessons, and give governors a report they can minute. Our managed security awareness training service takes the admin off the school business manager.
Contact us to plan cyber training for your school or trust.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is cyber security training mandatory for schools?
The DfE cyber security standards expect schools and colleges to train staff, at least one governor or trustee and others with a login at least annually. For RPA members, completing the NCSC training each year is a condition of cyber cover, and you must be able to evidence it.
Who needs to complete the NCSC training for RPA?
Staff and governors or trustees who have access to the school's or trust's IT systems. Check the current RPA membership rules on GOV.UK for the exact scope that applies to you, and keep a register of completion.
How often do school staff need cyber training?
At least once a year under the DfE standards, or more often if there is a known risk. A short termly lesson and occasional phishing simulations help the annual training stick.
Can we use a commercial platform instead of the NCSC training?
A platform can deliver and track the NCSC training alongside its own content. Whether another course counts for the RPA condition depends on the current RPA rules, so we build the programme around the NCSC training and add to it.
What evidence should a school keep?
A register showing each person in scope, the training completed, the date and how it was evidenced, kept with your backup tests, response plan and Police CyberAlarm registration.