Cybersecurity for Multi-Academy Trusts: MAT-Wide Security Governance and Shared Infrastructure Risks
Multi-academy trusts are one of the highest-risk structures in the UK education cybersecurity landscape. The Harris Federation attack of April 2021 — which took 50 schools offline simultaneously through a single ransomware campaign — demonstrated what happens when centralised infrastructure is compromised. A MAT's shared network, centralised email, common MIS platform, and unified IT management that create operational efficiency also create a single point of failure. One successful attack can disable every school in the trust at once. The DfE Cyber Security Standards (January 2023) require MAT boards to take personal accountability for cybersecurity governance across the entire trust — not just the central office, but every school.
Harris Federation 2021: one ransomware attack disabled 50 schools simultaneously through shared infrastructure — the defining risk of multi-academy trust centralised IT.
The MAT-Specific Threat Profile
Multi-academy trusts face cyber risks that individual schools do not: - **Scale amplification**: a single successful attack against shared infrastructure affects all schools simultaneously - **Complex attack surface**: the trust's network connects many schools, potentially including remote campuses - **Centralised high-value systems**: MAT finance, HR, and administrative systems are high-value ransomware targets - **Third-party risk aggregation**: a MAT that uses a single IT provider for all schools concentrates supply chain risk - **Governance complexity**: many schools, many headteachers, one central IT team — security policy enforcement is challenging
MAT-Wide Security Governance
Effective MAT security governance requires clear accountability structures: - **Trust board accountability**: the MAT board is responsible for setting cybersecurity policy and ensuring adequate resources - **CEO/COO ownership**: executive accountability for implementing the security programme - **Central IT lead responsibility**: the trust's IT director or manager is accountable for technical controls across all schools - **School-level leads**: each school should have a designated person responsible for local security matters (typically the headteacher or IT coordinator) - **Annual security reporting**: the trust board should receive an annual cybersecurity report, covering posture, incidents, and plans The DfE standards require this governance structure to be documented — not just practised informally.
Segmenting the MAT Network
The most important technical control for a MAT is network segmentation — ensuring that a compromise in one school cannot propagate across the entire trust. This means: - Schools should be segmented from the central trust network at the network level - Each school should be treated as a separate network zone with controlled communication to central systems - Finance and administrative systems at trust level should be isolated from school networks - Firewall rules between segments should be documented and reviewed annually For the Harris Federation, the ability of ransomware to spread across all 50 schools simultaneously indicates insufficient network segmentation. This is the most direct lesson from that incident for other MATs.
Centralised Security Controls That Work Across All Schools
MATs can leverage their scale to deploy security controls more effectively than individual schools can: - **MAT-wide MFA**: enforce MFA across all schools through centralised Azure AD or Google Workspace management - **Centralised email filtering**: deploy email security across all schools through a single platform - **Unified endpoint management**: manage and monitor all school devices through a single MDM - **Centralised backup**: use a MAT-wide backup platform that covers all schools, with independent copies for each school - **Single Cyber Essentials certification**: where infrastructure is shared, pursue a single MAT-level Cyber Essentials covering all schools
Incident Response at MAT Scale
A MAT incident response plan must account for the possibility that all schools are affected simultaneously — as occurred at Harris Federation. This means: - Communication plans that do not rely on school email (which may be compromised) - Designated out-of-band communication channels for the trust IT team - Pre-identified priorities: which schools' systems must be recovered first? - Relationship with a specialist incident response firm, established before an incident occurs - Tested tabletop exercise involving the trust board, CEO, and central IT team — not just IT staff - Documented relationship with NCSC Cyber Incident Response service
Frequently Asked Questions
Can a MAT get a single Cyber Essentials certificate for all its schools?
Yes, if the schools share a common network, email platform, and device management environment managed centrally by the trust. A single MAT-level Cyber Essentials certification can cover all schools under that shared infrastructure. Where individual schools have independent IT systems, separate certifications may be required. A certifying body with MAT experience can advise on scoping before the assessment — getting the scope right at the start avoids complications during the assessment.
What should MAT boards know about cybersecurity?
MAT boards are not expected to be technical experts. They are expected to: understand that cybersecurity is a governance risk they are accountable for; receive at least annual reporting on the trust's security posture; approve the trust-wide information security policy; ensure adequate budget is allocated for security across all schools; understand the trust's incident response plan at a high level; and know what they would do in the first hours of a major incident. Regular briefings from the trust IT director help boards stay informed without requiring technical deep-dives.
How should a MAT handle a school that has been individually compromised?
A compromised school is a risk to the entire MAT if network segmentation is insufficient. The first priority is isolating the compromised school's network from the rest of the trust. This means the ability to sever network connections between schools must be built into the network architecture in advance — not improvised during an incident. Once isolated, the school's recovery can proceed without risk of spread. The trust incident response plan should include specific procedures for this scenario.
Get MAT-wide security governance support from Kyanite Blue
Kyanite Blue specialises in cybersecurity for iGaming operators. MGA-licensed operators across Malta trust our stack.
Get in touchReady to secure your iGaming operation?
MGA-licensed operators across Malta trust Kyanite Blue.