Cybersecurity in Schools: Check your suppliers’ standards 

Schools are prime targets for cyberattacks. Learn why IT leads must check supplier certifications like ISO 27001 and Cyber Essentials to protect pupil and staff data.

If you work in school IT, you know cybersecurity risks are real.  

Schools are now prime targets for ransomware and phishing attacks, and with thousands of pupil and staff records on your systems, the fallout from a breach would be huge. 

Leadership teams in schools and trusts are already turning their concerns about cybersecurity into action.  

According to the British Educational Suppliers Association (BESA), a growing number of MATs are investing in trust-wide cybersecurity infrastructure and systems.  

However, there is a weak link in the chain of cybersecurity in schools that is frequently overlooked: 

Third-party suppliers and partners.  

From your MIS provider to your cloud platforms to your account automation tools, every one of them has access to sensitive information. 

And that’s why checking their cybersecurity certifications matters just as much as protecting your own network. 

For Cybersecurity Awareness Month we’ve put together this guide especially for schools and trusts.  

We cover:  

• What are cybersecurity standards and certifications? 

• Why supplier cybersecurity standards matter for schools 

• How schools can check supplier cybersecurity certifications 

• What is ISO 27001 – SalamanderSoft’s commitment to security

What are cybersecurity standards and certifications? 

Put simply, cybersecurity standards are frameworks that set the rules for how organisations protect data.  

Certifications prove that a company hasn’t just promised to follow those rules, they’ve been independently audited against them. 

Some key ones you’ll come across: 

• Cyber Essentials and Cyber Essentials Plus – a UK government-backed scheme covering practical protections like patching, access control and firewalls. 

• ISO 27001 – the international gold standard for information security, covering policies, processes, risk management and continual improvement. 

When a supplier holds these certifications, you know they’ve been tested, not just ticked their own boxes. 

Why supplier cybersecurity standards matter for schools 

When you connect systems together, your school’s security is only as strong as the weakest link. 

Vendors like MIS providers, cloud services, and automation tools handle sensitive data every day. If their processes aren’t robust, your school is carrying their risk. 

Checking certifications gives you confidence that: 

Data is protected to an international standard  

Your school data is protected to the same standard as global enterprises.  

Suppliers certified to frameworks like ISO 27001 follow strict, audited processes to keep information secure, from data encryption to access control.  

Processes are audited by an unbiased third party 

Certified suppliers are regularly reviewed by external auditors, ensuring that they’re actively managing risk, monitoring systems and continually improving their security processes. 

Compliance with GDPR and safeguarding is built in 

Cybersecurity standards make sure suppliers meet data protection requirements by design, making it easier for you to demonstrate GDPR and safeguarding compliance.  

Your staff and pupils are protected 

When your suppliers meet recognised cybersecurity standards, you’re protecting the people behind the data: your pupils, your staff and the wider school community.

How schools can check supplier cybersecurity certifications 

When you’re weighing up suppliers, it’s tempting to focus on features and cost. But if they don’t meet the right security standards, it’s not worth the risk. 

Here are some questions worth asking: 

• Do they hold Cyber Essentials or ISO 27001? 

• How do they manage access control and school leavers? 

• What’s their incident response plan if something goes wrong? 

The right certifications shift the burden away from you. You don’t have to prove your suppliers are secure, they’ve already been tested against a recognised standard. 

What is ISO 27001? SalamanderSoft’s commitment to security

At Salamander, we know schools trust us with their most critical data. That’s why we’re proud to hold ISO 27001 certification, the internationally recognised standard for information security. 

This means, as an organisation, we must have:  

Access control

Ensuring only authorised users can access sensitive information. This ensures that only the appropriate employees have access to our systems to perform their roles, and that access is promptly removed when they leave the company or transition to roles where it’s no longer needed. 

Data encryption and protection

Technical controls and processes we use to keep personal data secure, both when it’s stored and when it’s shared. 

Risk management

Identifying, assessing and mitigating risks to information. Gives schools confidence that their supplier actively monitors and manages threats, not just reacts to them. 

Incident response and recovery

Documented, tested processes for dealing with security incidents ensures a rapid, structured response if something ever goes wrong. 

Staff training and awareness

Regular training to prevent breaches caused by human error and lets schools know that supplier staff understand education data sensitivity and act accordingly. 

Physical and network security

Securing servers, offices and digital infrastructure, which shows protection goes beyond software and covers all physical and digital touchpoints. 

Continual improvement and auditing

Regular internal and external audits to maintain and improve security controls. This assures that security practices evolve with new risks, not once a year “box-ticking”.  

Cybersecurity isn’t just about what you do in-house. It’s about who you partner with and the suppliers you share data with.

This Cybersecurity Awareness Month, take a moment to check: are your suppliers certified to recognised standards?