Antivirus for schools and academies

What the DfE standards expect

The Department for Education publishes digital and technology standards for schools and colleges in England, including a set of cyber security standards. One of them is to protect devices and data with anti-malware and a firewall. In it, the DfE says IT support should:

• install anti-malware software, which must include anti-virus, on all devices
• make sure it is centrally managed, actively monitored and kept up to date, with a central console so IT support can step in if the software fails or does not update
• send malware alerts to IT support, who then investigate
• review the anti-malware software termly to check it still meets the school's needs
• configure the network to limit the spread of malware to critical systems

The DfE says this standard should already be in place. The other cyber security standards cover yearly risk assessment, a cyber awareness plan for staff and students, account and access management, licensing and updating technology, backups and reporting incidents. If your school has risk protection arrangement (RPA) cover, the standards say you must be able to evidence that relevant staff have completed the NCSC's free cyber security training, taken annually, and that backups to the stated level and a cyber response plan are conditions of RPA cover.

Antivirus is one standard among several, but it is one of the easiest to evidence well with the right product: a central console shows that every device is protected, up to date and reporting. Schools outside England should check their own nation's guidance.

What needs protecting in a school

Schools and academies often have a wider mix of devices than a business of a similar size:

• Staff laptops, which go home in the evening and need protection off the school network.
• Office and finance PCs, which handle payments, pupil records and the management information system.
• Servers, on site or in the cloud, which hold shared drives and applications. Servers usually need their own licences; see server antivirus.
• Macs and iPads in creative subjects, music and early years. See antivirus for Macs and mobile antivirus for business for how those are protected.
• Shared classroom and suite PCs, used by many pupils a day.
• Headteacher and governor devices, sometimes personal, that access school email.

The DfE standard says all devices, so a product that covers Windows, macOS, servers and mobile devices from one console saves a lot of effort. Most of the business products we supply cover Windows, macOS and Linux, and several add iOS and Android.

Per-user or per-device licensing for shared devices

Licensing is easy to get wrong in a school, because device and user counts look very different from a business:

The right answer depends on your ratio of staff, shared devices and servers, and we can model the options from your numbers. Our licensing site has a wider guide to education and charity licensing, including how education terms work for other software.

Central management for a small IT team

Many schools have a small IT team, or a support provider who visits on set days. That makes central management the single most important feature:

• One console for staff laptops, office PCs, servers and Macs, ideally the same console that shows alerts.
• Policies by group, so office PCs, classroom PCs and servers each get the right settings, including web protection that complements your filtering.
• Alerts to the right people: the DfE standard expects malware alerts to reach IT support for investigation, so decide who receives them out of school hours and during holidays.
• Reports for governors and auditors: protection status and detections, ready for the termly review.
• Automatic updates, so devices that sit unused over the holidays catch up when they return.

If no one is available to act on alerts, several vendors offer managed services run by their own analysts; see managed antivirus for how that works and what to check.

Cyber Essentials and wider cyber security

The DfE says Cyber Essentials is a requirement for colleges under their funding agreement, and that some schools may wish to complete it as part of their cyber security work. Its malware protection control asks for an active, up-to-date mechanism on every in-scope device, which a centrally managed product makes straightforward to show. Our sister site covers Cyber Essentials for schools.

Antivirus also sits beside the other standards. Ransomware is a particular concern for schools because it can take management information systems and shared drives offline; our ransomware protection guide covers the layers, including backup. Staff awareness matters just as much, and security-awareness-training.co.uk has a guide to security awareness training for schools.

Criteria for choosing

Rather than a list of products ranked against each other, use these criteria to compare:

1. Does it cover every device type you have: Windows, Macs, servers, iPads and other tablets?
2. Is it managed from one cloud console, with no server to maintain on site?
3. Does the licence model suit your mix of staff, shared devices and servers?
4. Can alerts reach the right person, and is there a vendor-run service if no one can act on them?
5. Does it produce the reports you need for governors, Cyber Essentials and the termly review?
6. Is there an upgrade path to detection and response if your insurer or trust asks for it later?

Multi-academy trusts often add a seventh question: can each school be managed separately while the trust sees everything? Some consoles are built for that kind of multi-site view, and we can check it for the products you shortlist. For the broader product comparison see endpoint protection vendors, and for small-organisation criteria see antivirus for small business.

Switching antivirus in a school

Changing product in a school is easier than it sounds if it is timed and planned well:

1. Pick a window, ideally a half term or the summer holiday, when shared devices are not in use.
2. Export your current exclusions, especially for the management information system, finance software and any on-site servers.
3. Build groups and policies in the new console: staff devices, office PCs, classroom PCs, servers and Macs.
4. Remove the old product and deploy the new agent through your device management or group policy.
5. Check every device reports in, then deal with any that were switched off or away from school.
6. Agree who receives alerts during term time and holidays, and note the date of the first termly review.

Staff laptops that are at home during the switch need a plan too: most cloud-managed products can install over the internet, so devices pick up the new agent the next time they connect. If you also want to update how devices are managed, Forever Group can help with mobile device management.

How we help

Forever Systems supplies antivirus to schools, academies and trusts from the vendors above. We can:

• count staff, shared devices and servers and model per-user and per-device options
• recommend products that cover your mix of Windows, Macs, servers and tablets from one console
• help plan the switch from your current product, ideally in a holiday
• set up groups, policies and alert routing so the termly review is easy to evidence

Contact us with your rough device numbers and ask us for a quote.