Security & resilience
Cyber security for colleges and universities
Colleges in England must hold Cyber Essentials under their funding agreement, and the DfE cyber security standard sets out patching, backup and MFA guidance and who to report incidents to. For universities, the NCSC’s threat assessment is the main official reference we found.
On this page
At a glance
- “Colleges must hold [Cyber Essentials] under their funding agreement” — DfE cyber security standard.
- DfE guidance: critical or high patches within 14 days, DfE security instructions within 5 working days, 3-2-1 backups tested termly, MFA for cloud, remote and admin access.
- An FE institution should consider reporting an incident to Jisc as well as to Report Fraud, the DfE sector cyber team, its insurer or RPA, and the ICO.
- The NCSC judges criminals and nation states the main threats to universities (assessment first published 2019).
Colleges in England: the DfE cyber security standard
The DfE cyber security core standard (last updated 16 September 2026) has one point that is a firm requirement for colleges:
KCSIE 2026 also says colleges should consider the DfE cyber security standards.
The standard’s other figures are guidance:
| Area | DfE guidance |
|---|---|
| Patching | Critical or high patches within 14 days |
| DfE security instructions | Applied within 5 working days |
| Backups | 3-2-1 backups, tested termly |
| Access | Multi-factor authentication for cloud, remote and admin access |
| Firewalls | Rules reviewed termly |
Jisc offers Cyber Essentials and Cyber Essentials Plus as optional extras to FE members, alongside penetration testing, a security operations centre and cyber security threat monitoring.
Reporting an incident
The standard says a further education institution should also consider reporting an incident to Jisc, as well as to:
- Report Fraud (0300 123 2040);
- the DfE sector cyber team (Sector.Incidentreporting@education.gov.uk);
- its risk protection arrangement (RPA) or insurer;
- the ICO, within 72 hours, for high-risk data breaches.
Jisc’s CSIRT can be reached on 0300 999 2340 (08:00–18:00, Monday to Friday) or irt@jisc.ac.uk — see DDoS protection and Jisc’s CSIRT.
Universities
The NCSC’s assessment The cyber threat to universities judges that the main threats are financially motivated criminals and nation states. Cyber crime is “probably” the most evident and disruptive, while state-sponsored espionage is likely to do greater long-term damage — especially to the value of research.
We found no Office for Students requirement specific to cyber security, and no current NCSC guidance page specific to FE colleges — the NCSC’s education pages we found are aimed at schools.
Suppliers who say they provide cyber security services are in our supplier directory.
Sources
Checked 25 October 2026. We wrote this guide from these sources, in our own words:
- DfE: Cyber security core standard (gov.uk)
- NCSC: The cyber threat to universities (ncsc.gov.uk)
- NCSC: Cyber security for schools (ncsc.gov.uk)
- Jisc: CSIRT (jisc.ac.uk)
- Jisc: Catalogue of services for further education (jisc.ac.uk)
- Keeping children safe in education 2026 (DfE) (assets.publishing.service.gov.uk)
Broadband for Education is an independent guide. It is not a broker or a supplier, and it is not owned by, or connected to, Jisc, any network provider, framework or government body. Spotted something out of date? Tell us.