Self-assessment tells you where you think you stand. Cyber Readiness proves it.
Cyber Readiness is our structured cyber security assessment for schools and Multi-Academy Trusts: where you stand today, what to do next, and the assurance to prove it. We are an NCSC-assured Cyber Advisor, and our three-stage assessment aligns to the Department for Education (DfE) Cyber Security Standards. It was developed through a national schools cyber readiness pilot. Start with our free self-assessment, or commission the full assessment.
Start free, or start with the full assessment
Most schools begin with the free self-assessment to get a high-level position, then commission the full assessment when they want the evidence behind it.
Cyber Readiness Self-Assessment
A structured questionnaire covering governance, access control, backups, filtering and incident readiness. You complete it, and we return a high-level executive summary showing where you stand against the DfE Cyber Security Standards.
It is genuinely free and there is no obligation to go further. Share your details and we will send you the questionnaire.
Full Cyber Readiness Assessment
Our three-stage assessment: a guided fact-find validated by our team, an automated internal and external penetration test, and a synthesised report with a gap analysis and a prioritised improvement plan, walked through at a closing review.
This is the assessment that gives you evidence rather than a self-reported position, and a plan you can budget against.
Schools know cyber matters. Most cannot see where they stand.
Schools and trusts are under growing pressure to demonstrate cyber resilience, but most lack the internal capability, evidence base and structured plan to do so. The gap has three layers.
Risk to curriculum continuity
Cyber incidents disrupt teaching, expose personal data, and carry safeguarding consequences. When systems are lost, the immediate impact is on curriculum continuity and on the duty to protect pupil and staff data under GDPR.
A baseline, unevenly met
The DfE Cyber Security Standards set a clear baseline across governance, network security, access control, backups and incident response. They do not tell a school how to measure its current position, or how to prioritise the gap. Ofsted, governor and RPA scrutiny add further pressure. Cyber security is also one of the DfE core digital and technology standards that schools and colleges are expected to meet by 2030.
No dedicated security function
Most schools do not have a dedicated security team, and non-technical leaders need a clear view of risk they can act on and justify spend against. The problem is rarely a shortage of tools. It is not knowing where you stand, where to start, or how to show progress.
Three stages, one clear outcome
A guided fact-find, an automated network penetration test, and a synthesised report written for both technical and non-technical readers.
Pre-assessment
A guided fact-find across governance, policies, network configuration, access control, backups, filtering and incident readiness. Self-assessment by the school, validated by our team, sets the baseline.
Assessment
An automated internal and external network penetration test: a sweep of up to 500 IP addresses, scoped across a representative selection of your core technology sets. It finds open ports, misconfigured services, unpatched software and weak credentials, combined with the governance findings for a complete view.
Post-assessment
A technical findings report for IT and a plain-English executive summary for leadership, an overall maturity position, and a prioritised improvement plan, walked through at a closing review.
Everything the assessment covers
How the assessment works
The three stages in detail, from guided fact-find to executive report, and the deliverables you receive.
View
What we assess and scope
The domains we assess, how findings map to NCSC, Cyber Essentials and the DfE standards, and what is in and out of scope.
View
Cyber Readiness for trusts
Consolidated assurance across a Multi-Academy Trust, and the annual and termly assessment cadences.
ViewAssessed against the standards that matter
Findings are framed against NCSC guidance, Cyber Essentials principles and the DfE Cyber Security Standards, so your position is measured against recognised good practice rather than a supplier opinion.
Every assessment gives you an overall maturity position, for example Developing, so you can measure progress over time and evidence it to governors, trustees and the Risk Protection Arrangement.
NCSC, Cyber Essentials, DfE
Cyber Essentials and Cyber Essentials Plus follow naturally as outcomes of the work, rather than being the starting point. The assessment shows you what to fix first to get there.
An NCSC-assured Cyber Advisor
Medhurst Communications is certified under the National Cyber Security Centre Cyber Advisor scheme, delivered with IASME. The scheme assures organisations to give practical, proportionate cyber security advice to schools and other small and medium organisations, focused on implementing the Cyber Essentials technical controls. Our qualified Cyber Advisor is Gareth Davies.
For a school or trust it means the cyber advice you receive is independently assured by the UK technical authority for cyber security, not simply asserted.
Assess, then remediate
The assessment identifies and prioritises. Where you want the issues fixed, the same team can remediate them through our networking, filtering, servers, devices and managed IT capability. A remediation credit applies: 20% off remediation professional services taken as a result of your assessment. The detail and our certificates sit on the Compliance Posture page.
Cyber Readiness: your questions answered
What is a cyber security assessment for schools?
Cyber Readiness is a structured, three-stage assessment that shows a school or trust where it stands against recognised good practice, gives a prioritised improvement plan, and provides a route into remediation. It combines a guided fact-find, an automated network penetration test, and a synthesised report for technical and non-technical readers.
Is it aligned to the DfE Cyber Security Standards?
Yes. Findings are framed against the DfE Cyber Security Standards, NCSC guidance and Cyber Essentials principles, and you receive an overall maturity position so progress can be measured over time. Medhurst is an NCSC-assured Cyber Advisor.
Does it include fixing the issues found?
The assessment identifies and prioritises issues. Remediation is a separate, scoped engagement delivered through our managed services and infrastructure capability, so the supplier who finds the problem can also help fix it. A remediation credit applies: 20% off remediation professional services taken as a result of your assessment.
Can you assess a whole multi-academy trust?
Yes. The assessment can be run consistently across member schools with consolidated reporting at trust level, giving central leadership a comparable view of cyber posture across the estate. Trusts gain the fullest view: a consolidated, comparable picture across every school in the estate.
How often should a school reassess?
The assessment is offered three ways: a one-off assessment, an annual cadence for a baseline position, or a termly cadence for continuous assurance. Termly keeps the improvement plan current and tracks remediation progress across the year.
Is there a free option?
Yes. The Cyber Readiness Self-Assessment is a free structured questionnaire. You complete it, we return a high-level executive summary of where you stand against the DfE Cyber Security Standards, and there is no obligation to go further. Share your details and we will send it to you.
We have completed the DfE digital standards self-assessment. Do we still need this?
They do different jobs. A self-assessment records your own answers; Cyber Readiness validates them with an internal and external penetration test and gives you the evidence behind the position. Our free self-assessment is a good first step; the full assessment is how you prove it.
How much does a Cyber Readiness assessment cost?
Assessments start from £2,995, with defined scope and defined cost. Pricing depends on the size of your network and whether you choose a one-off assessment, an annual cadence, or a termly cadence. Tell us about your school or trust for a precise figure.
Strategic partnerships, tailored solutions
Remediation draws on our cyber security partnerships, Sophos and Fortinet as primary partners, with alternatives selected to your need, and our safeguarding filtering and monitoring partnerships led by Smoothwall.
Industry accreditations
Book a Cyber Readiness assessment
Tell us about your school or trust and we will explain the three stages, the free self-assessment, and the options for re-assessment on a regular cadence.