iso27001partnersAcademy trust cyber security: what the 2026 handbook requires of trustees
“Trusts must not pay any ransom or extortion demands, including cyber ransomware.”
The Academy trust handbook 2026 took effect on 1 October 2026. Cyber security appears in it in two ways: directly, in the paragraphs on cybercrime and ransoms, and indirectly, through the duties every trust already has — a risk register the board reviews, a programme of internal scrutiny, and an audit and risk committee. This page is for trustees and committee members. It sets out those duties from the handbook's own text and shows where an information security management system such as ISO 27001 would sit against them.
The handbook paragraphs that bear on cyber risk
None of these paragraphs is written only about cyber security, apart from 6.14 and 6.15. All of them apply to it, because a cyber attack is a risk to the trust's operation, its money and its pupils' data.
| Para | Topic | The handbook says |
|---|---|---|
| 2.6 | Internal control | “The academy trust must have sound internal control, risk management and assurance processes.” |
| 2.7 | Risk register | The control framework must “ensure a risk register is maintained and reviewed by the board, drawing on advice provided to it by the audit and risk committee” |
| 2.43 | Managing risk | “The trust must manage risks to ensure its effective operation.” … “the trust must maintain a risk register” |
| 2.45 | Insurance or RPA | “The academy trust must have adequate insurance cover in compliance with its legal obligations or be a member of the academies risk protection arrangement” (RPA) |
| 3.1 | Internal scrutiny | “All academy trusts must have a programme of internal scrutiny to provide independent assurance to the board that its financial and non-financial controls and risk management procedures are operating effectively.” |
| 3.6 | Audit and risk committee | “The academy trust must establish an audit and risk committee, appointed by the board.” |
| 6.10 | Fraud reporting | “The board of trustees must notify DfE as soon as possible of all instances of fraud, theft or irregularity exceeding £5,000 individually, or £5,000 cumulatively in any financial year.” |
| 6.14 | Cybercrime controls | “Academy trusts must also be aware of the risk of cybercrime, put in place proportionate controls and take appropriate action where a cyber security incident has occurred.” |
| 6.15 | Ransoms | “Trusts must not pay any ransom or extortion demands, including cyber ransomware.” |
The risk register: where cyber risk is owned
“The trust must manage risks to ensure its effective operation.” The same paragraph says “the trust must maintain a risk register”, and the control framework in 2.7 must “ensure a risk register is maintained and reviewed by the board, drawing on advice provided to it by the audit and risk committee”. And: “overall responsibility for risk management, including ultimate oversight of the risk register, must be retained by the board of trustees”.
What a cyber line in the register should let the board see
The handbook does not prescribe the format. For a cyber entry to be reviewable by a board it needs, at minimum, what could happen, how likely and how serious it is judged to be, what controls are in place, who owns it and what is still to be done. That list is our reading of what “reviewed by the board” needs in practice, not the handbook's wording.
Linking the register to the DfE standards
The first DfE cyber security standard is an annual cyber risk assessment. Its result is the natural source for the register's cyber entries. The DfE standards themselves are set out on our schools and colleges page.
Internal scrutiny covers non-financial controls
“All academy trusts must have a programme of internal scrutiny to provide independent assurance to the board that its financial and non-financial controls and risk management procedures are operating effectively.” The words “non-financial controls” matter: internal scrutiny is not limited to the accounts, and IT and data controls fall inside it.
What internal scrutiny must focus on
Paragraph 3.2 lists the focus as:
- evaluating the suitability of, and level of compliance with, financial and non-financial controls
- offering advice and insight to the board on how to address weaknesses in financial and non-financial controls
- ensuring all categories of risk are being adequately identified, reported and managed
Choosing what to review
“The trust must identify on a risk-basis (with reference to its risk register) the areas it will review each year.” If cyber risk sits high on the register, that is the handbook's own route to putting it in the year's review plan.
Who can do it
Paragraph 3.17 lists the options for delivering internal scrutiny and adds that all trusts, regardless of income, “may also use other individuals or organisations where specialist non-financial knowledge is required”. A cyber review is that kind of specialist work. Independence comes from the reporting line: “Independence in internal scrutiny must be achieved by establishing appropriate reporting lines, whereby those carrying out checks report directly to a committee of the board, which in turn provides assurance to the trustees.”
The audit and risk committee
“The academy trust must establish an audit and risk committee, appointed by the board.” Trusts with annual revenue income over £50 million, based on their last audited accounts, “must have a dedicated audit and risk committee”; “other trusts must either have a dedicated audit and risk committee or can combine it with another committee, such as finance”. “The audit and risk committee should meet at least 3 times a year.”
What the committee must do
Paragraph 3.8 says the committee must:
- oversee and approve the trust’s programme of internal scrutiny
- ensure that risks are being addressed appropriately
- report to the board on the adequacy of the trust’s internal control framework, including financial and non-financial controls and management of risks
Questions a committee can put on cyber risk
These follow from the duties above; they are our suggestions, not handbook text. When was the cyber entry on the risk register last reviewed, and what changed? Which of the seven DfE standards does the trust meet today, and which not? Has a cyber review been in the internal scrutiny programme, and what did it find? If systems were encrypted tomorrow, how would the trust restore them without paying?
RPA, insurance and staff training
“The academy trust must have adequate insurance cover in compliance with its legal obligations or be a member of the academies risk protection arrangement” (RPA). “Not all risks are covered in the RPA and therefore trusts with RPA cover may require additional commercial insurance.”
The DfE cyber security standards attach an evidence duty to RPA membership: “If you have risk protection arrangement, you must evidence that the relevant users have undertaken the free National Cyber Security Centre (NCSC) training.”
Ransoms and recovery
“Trusts must not pay any ransom or extortion demands, including cyber ransomware.” “Payment of ransoms or extortion demands has no guarantee of restoring access or services and is likely to result in repeat incidents.”
Because paying is not open to a trust, recovery depends entirely on backups and restoration. The sixth DfE standard is a back-up plan. That link is our reading.
Reporting to DfE after an incident
“The board of trustees must notify DfE as soon as possible of all instances of fraud, theft or irregularity exceeding £5,000 individually, or £5,000 cumulatively in any financial year.” “Unusual fraud, regardless of value, must also be reported.” Where an attack involves personal data, the trust also has the breach duty under UK GDPR Article 33.
Where ISO 27001 fits (our reading)
The handbook does not mention ISO 27001 and does not require any certification of a trust. What it does require — a risk register, a scrutiny programme with independent reporting, and a committee that reports to the board — has close equivalents in the ISO 27001 management system clauses. ISO 27001 clause 6.1.2: “The organization shall define and apply an information security risk assessment process that:” and clause 9.2.1: “The organization shall conduct internal audits at planned intervals to provide information on whether the [information security] management system: a) conforms to: the organization’s own requirements for its [information security] management system; the requirements of this document; b) is effectively implemented and maintained.”
| Handbook duty | ISO 27001 clause | How they compare |
|---|---|---|
| Risk register maintained and reviewed by the board (2.7, 2.43) | Clause 6.1.2 information security risk assessment; 6.1.3 risk treatment | ISO 27001 asks for information security risks to be identified, analysed and evaluated against criteria the organisation sets, so its output can supply the register's cyber entries |
| Internal scrutiny programme, risk-based (3.1, 3.3) | Clause 9.2 internal audit — an audit programme with frequency, methods and reporting | Both ask for a planned programme of checks that reports upwards |
| Independence through reporting lines (3.5) | 9.2.2 b) “select auditors and conduct audits to ensure objectivity and the impartiality of the audit process” | The handbook gets independence from who the reviewer reports to; ISO 27001 asks for objectivity in choosing auditors |
| Audit and risk committee reports to the board (3.8) | Clause 9.3 management review by top management | Both put the results in front of the people accountable |
| Cybercrime controls and the DfE standards (6.14) | Annex A controls, applied through the statement of applicability | The DfE standards are a short control set; Annex A is a longer one chosen by risk |
Certification is a choice, not a duty
A trust can use the ISO 27001 structure without being certified. Certification adds an external audit by an accredited body, which a board may want as assurance; whether that is worth the cost is a judgement for the board. Costs are on ISO 27001 certification cost.
One register, three uses
A cyber risk assessment done to the first DfE standard can feed the board's risk register, set the internal scrutiny plan and give the audit and risk committee something specific to review.
We do not audit, certify or consult, and the only payment we will accept is the same fixed fee per enquiry whichever firm you use. The handbook is quoted from GOV.UK; the committee questions and the ISO mapping are our reading.
Where this fits
Common questions
What does the Academy trust handbook 2026 say about cyber security?
Paragraph 6.14: “Academy trusts must also be aware of the risk of cybercrime, put in place proportionate controls and take appropriate action where a cyber security incident has occurred.” “Trusts should take appropriate action to meet DfE’s cyber security standards, which were developed to help them improve their resilience against cyber-attacks.” Paragraph 6.15 bars ransom payments. Paragraph 1.21 sets the wider digital standards target.
Can an academy trust pay a ransomware demand?
No. “Trusts must not pay any ransom or extortion demands, including cyber ransomware.” The handbook adds: “Payment of ransoms or extortion demands has no guarantee of restoring access or services and is likely to result in repeat incidents.”
Does an academy trust need ISO 27001?
No. The handbook does not mention ISO 27001 and does not require any certification of the trust itself. It requires internal control, a risk register, internal scrutiny and controls against cybercrime. ISO 27001 is one way to organise those controls — our reading, not a DfE statement.
Who is responsible for cyber risk in an academy trust?
The board. Paragraph 2.43: “the trust must maintain a risk register”, and “overall responsibility for risk management, including ultimate oversight of the risk register, must be retained by the board of trustees”. The audit and risk committee must “ensure that risks are being addressed appropriately”.
Can internal scrutiny cover cyber security?
Yes. Paragraph 3.1 covers non-financial controls as well as financial ones, and paragraph 3.17 says trusts “may also use other individuals or organisations where specialist non-financial knowledge is required”.
How often must the audit and risk committee meet?
“The audit and risk committee should meet at least 3 times a year.”
Does a cyber attack have to be reported to DfE?
If it involves fraud, theft or irregularity, paragraph 6.10 applies: “The board of trustees must notify DfE as soon as possible of all instances of fraud, theft or irregularity exceeding £5,000 individually, or £5,000 cumulatively in any financial year.” “Unusual fraud, regardless of value, must also be reported.” A personal data breach has its own duty under UK GDPR Article 33.
Sources cited on this page
- Department for Education, Academy trust handbook 2026 (effective from 1 October 2026)
- Department for Education, Cyber security standards for schools and colleges (updated 16 September 2026)
- ISO/IEC 27001:2022, official preview (clauses 1 to 6.3 and contents), read first-hand
- ISO/IEC Harmonized structure for MSS with guidance for use (formerly Annex SL Appendix 2 of the ISO/IEC Directives, Part 1), approved 30 July 2025
Every figure above was read from the source it is attributed to on 20 September 2026. Figures that are our own arithmetic rather than a published rule are labelled as estimates wherever they appear. How we check this.
Reviewing cyber risk for a trust?
Say how many schools, what the committee has asked for, and your deadline.
Your enquiry is ready to send
Here is what happens after you submit:
- We pass your answers only to ISO 27001 consultancies taking enquiries for your sector, when one is.
- No more than three may contact you, and only using the details you gave.
- You decide who, if anyone, you speak to. You are committed to nothing.
We are not a certification body and cannot issue, arrange or influence a certificate. Only a UKAS-accredited certification body can do that, and you appoint it yourself.