In short
Zero trust in education means staff, contractors and personal devices reach MIS, finance and research systems one application at a time, after identity and device checks. For UK trusts, colleges and universities it starts with MFA and named accounts, which the DfE's cyber security standards require for staff remote access, then per-app ZTNA and segmentation.
Get a quote for zero trust for education
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
Who this page is for
This page is for IT leads, network managers and digital leads at multi-academy trusts, local authority school groups, further education colleges and universities, and the IT support companies that work for them.
Education networks are some of the hardest to secure. They serve large numbers of users who change every year, a mix of school-owned and personal devices, contractors and visiting staff, and systems that range from the management information system (MIS) and finance to research data and building controls. A remote access VPN that puts every authenticated user on the network was never a good fit for that mix.
Zero trust starts from a different place: no device or network is trusted by default, and each request to each system is checked. For the background, see what zero trust security is and the zero trust principles.
Why education needs zero trust
| Education challenge | Risk with network-level access | Zero trust response |
|---|---|---|
| Bring your own device (BYOD) for staff and visitors | Personal devices join the network with unknown health | Browser-based access to named applications, with nothing installed on the device |
| Contractors, IT support companies and software suppliers | Shared or long-lived accounts with broad access | Named, time-limited access to the system they support, with sessions logged |
| MIS, finance and HR systems | Anyone on the VPN can try to reach them | Per-app access for the roles that need each system, with MFA |
| Research data in universities | Research groups, partners and visiting academics share networks and storage | Access granted per project and per application, separate from teaching and admin systems |
| Trust-wide estates and mergers | Every school or campus adds a network to join up | Cloud-brokered access to central systems without merging networks first |
| Labs, AV and building systems | Older devices on the same network as staff PCs | Segmentation so devices are reachable only by the systems that manage them |
Not sure which level fits? Ask us
Tell us what you need and we will recommend the right level for your organisation, with a quote.
DfE cyber security standards and NCSC guidance
The Department for Education publishes cyber security standards for schools and colleges (opens in a new tab) as part of its digital and technology standards (the core standard page was updated on 16 September 2026). Several of its technical requirements line up directly with zero trust:
- MFA: MFA must be enabled for all staff accounts with access to cloud services or remote access to on-site systems, and for IT administrative accounts.
- Least privilege: users should only have the network and data access they need, with access privileges limited to what each role requires.
- Remote access: remote access should be disabled when not required and enabled only by authorised school or college staff.
- Joiners and leavers: accounts are created only when needed and disabled as soon as someone leaves, and the standard suggests tools that link to the MIS to create and delete accounts automatically.
- Single sign-on: where staff use several systems, it suggests considering single sign-on.
The DfE page also notes that Cyber Essentials is a requirement for colleges under their funding agreement; see Cyber Essentials for schools and colleges (opens in a new tab). The DfE standards cover schools and colleges; universities set their own policies, and many use the NCSC's zero trust architecture design principles (opens in a new tab) as a reference. Filtering and monitoring have their own DfE standards (see the filtering section below).
Zero trust architecture in higher education and schools: the approach
- Identity first. Named accounts for every member of staff, contractor and visitor, MFA on every remote and administrative sign-in, and joiner and leaver processes linked to the MIS or HR system.
- Inventory systems. List MIS, finance, HR, safeguarding, file shares, research storage and anything else reached remotely, with the groups that use each one.
- Per-app ZTNA instead of a VPN. Staff on managed devices reach each application through a zero trust network access broker after a device check, rather than joining the network.
- Agentless access for BYOD and visiting staff. Personal and partner devices use browser-based access to the specific applications they need; see agentless ZTNA.
- Segment labs, AV and building systems. Keep older and shared devices in their own segments; our zero trust network guide covers the design.
- Retire old routes and review. Close the VPN and any exposed remote desktop once systems have moved, then review access each term, which also matches the DfE's termly account reviews.
For universities, the same steps apply with one addition: research groups often need their own access policies for partners and visiting academics, so plan research data as a separate set of applications from teaching and administration.
Is zero trust for education the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Products we supply for schools, colleges and universities
| Need | Approach | Products we supply |
|---|---|---|
| Staff access to MIS, finance and file shares | Client-based ZTNA with device checks | Cisco Secure Access (opens in a new tab), Check Point ZTNA, Timus, NordLayer |
| BYOD, contractors and visiting staff | Agentless ZTNA or an enterprise browser (opens in a new tab) | Island Private Access, Check Point Enterprise Browser (opens in a new tab) |
| Remote desktops for admin and curriculum servers | Brokered RDP with MFA | TruGrid SecureRDP |
| Labs, AV and building devices | Microsegmentation | Zero Networks segmentation (opens in a new tab) |
| MFA for staff sign-in | Phishing-resistant MFA in front of applications | Cisco Duo for schools (opens in a new tab) |
The products differ mainly in where the policy is enforced and what the user installs. Island says its Private Access (opens in a new tab) runs inside its Enterprise Browser on managed or unmanaged devices, including BYOD, without agents, portals or VPNs. Check Point describes its SASE Enterprise Browser (opens in a new tab) as giving unmanaged devices controlled access, with an agentless device posture check and integration with its Agentless ZTNA. Vendor descriptions checked 9 November 2026.
Licensing is per user for most ZTNA platforms and enterprise browsers, and per protected device for segmentation. Subscriptions can be billed monthly, terms confirmed at quote; see ZTNA cost for how pricing is structured.
Filtering, connectivity and the SASE angle
Zero trust access controls who reaches which internal system. Web filtering for pupils and students is a separate requirement, covered by our sister site's guides to web filtering for schools (opens in a new tab) and PDNS for Schools (opens in a new tab). If you want filtering, branch security and access in one cloud platform, that is SASE for schools (opens in a new tab), covered on our SASE site.
How we help education IT teams
Forever Systems supplies the ZTNA, enterprise browser, remote desktop and segmentation products on this site. We can review how staff, contractors and personal devices reach your systems today, recommend an approach for a trust, college or university, run a pilot with one school, department or campus, and help roll it out in stages. Scope and timescales are confirmed at quote.
Contact us to talk through your plans.
How Forever Systems helps with ZTNA
Forever Systems supplies and supports several zero trust network access platforms, so we can recommend what fits how your people work and the tools you already run.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across the ZTNA products we supply, including Cisco Secure Access (opens in a new tab) and Check Point Private Access
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is zero trust in education?
Zero trust in education is a security approach where staff, contractors and devices are not trusted just because they are on the school, college or campus network. Each request to a system such as the MIS, finance or research storage is checked against identity, device and context, and access is limited to what each role needs.
What does zero trust architecture in higher education look like?
In a university it usually means one identity provider with MFA for staff, researchers and partners, per-app ZTNA instead of a campus VPN, browser-based access for personal and partner devices, separate access policies for research data, and segmentation for labs and building systems.
Is ZTNA suitable for schools?
Yes, particularly for multi-academy trusts with central MIS, finance and file systems. Staff reach each application after MFA and a device check, contractors get named and time-limited access, and the trust avoids joining every school's network through site-to-site VPNs.
Do the DfE cyber security standards require zero trust?
They do not use the term, but several requirements match zero trust controls: MFA for staff remote and cloud access and for admin accounts, access limited to what each user needs, remote access disabled when not required and prompt removal of leavers' accounts.
How do we give BYOD users access without a VPN?
Use agentless ZTNA or an enterprise browser. The user signs in through the browser with their named account and MFA and reaches only the applications they are allowed, without installing a client or joining the network.
Still have a question about zero trust for education?
Ask us and a member of our team will get back to you.