At 07:10 on a Tuesday, the IT lead at a twelve-school academy trust finds the central servers encrypted. By 07:40, twelve headteachers have each started a response of their own, and the central team is answering the same three questions for the twelfth time.
Who manages a cyber incident in a multi-academy trust has to be decided before the attack: the trust runs the incident through one named incident lead, and each headteacher runs their own school inside it.
In a multi-academy trust, a cyber incident that reaches every school is a single incident, and the trust should run it. One named incident lead, with a deputy, owns reporting, recovery and the line to parents. Each headteacher runs the school's response and reports status into one shared timeline.
What Is A Trust-Wide Cyber Incident?
A trust-wide cyber incident is an attack or outage that reaches more than one school because the schools share systems: a central management information system (MIS), one email service, one network or one IT provider. A single fault in that shared layer can stop registers, email and phones in several schools within the same hour.
The Department for Education (DfE) allows for this. Its cyber security standard for schools and colleges, updated on 16 September 2026, warns that an attack can affect other schools on the same wider network, such as those within a multi-academy trust.
Most guidance is still written one school at a time. The DfE's Cyber Security Hub lists roles for a school, led by a senior leadership team (SLT) digital lead. It doesn't say who leads when twelve schools share one server room. That gap is the question of who manages a cyber incident in a multi-academy trust.
Why Does It Matter Who Manages A Cyber Incident In A Multi-Academy Trust?
A multi-academy trust is one legal body with one board, one insurer and one set of reporting duties, no matter how many schools it runs. If twelve headteachers each act alone, the trust can report the same attack twice, contradict itself to parents and lose the single record of decisions that trustees and the insurer will ask for.
The Academy Trust Handbook 2026, effective from 1 October 2026, puts the weight on the trust. The board holds collective accountability and responsibility for the trust (paragraph 1.10), and the trust's management of risks must include contingency and business continuity planning (2.44).
Which Decisions Sit With The Trust And Which With Each School?
The trust decides anything that affects more than one school or commits the trust as a legal body: declaring the incident, technical containment, external reporting, the core message and any contact with the attacker. Each school decides what only that school can judge, which is whether it can open safely today and how its pupils are kept safe.
Reporting shows why. As at October 2026, the DfE standard says to report a cyber attack to the risk protection arrangement (RPA) or cyber insurer, to Report Fraud and to the DfE sector cyber team. The National Cyber Security Centre (NCSC) is added in some cases, one of which is the closure of more than one school. Only the trust can count closed schools, which is why who manages a cyber incident in a multi-academy trust can't be left to each school.
This article covers England and is orientation, not legal advice. Trusts and school groups elsewhere should check what their own regulator expects.
The table sets out a workable split of multi-academy trust incident response roles across six decisions, showing what the trust holds and what each school holds.
| Decision | Held By The Trust | Held By Each School |
|---|---|---|
| Declaring the incident | The incident lead declares it and activates the plan | The headteacher confirms what is affected on site |
| Opening or closing a school | Sets the criteria in advance and is told at once | The headteacher judges whether the school can open safely |
| Messages to parents and staff | Writes one agreed line and approves changes | Sends it with the school’s own details |
| Safeguarding | Checks that every school has cover | The designated safeguarding lead (DSL) runs it on site |
| Insurer, Report Fraud, DfE and ICO | One named person reports for the whole trust | Passes facts to the trust and does not report separately |
| Record of decisions | Keeps one timeline for the incident | Logs its own actions and feeds them in |
The second row causes most of the arguments. Whatever the trust's scheme of delegation says about closing a school, write the criteria down before the incident. Then a headteacher at 07:40 is applying a rule, and nobody has to invent one.
Should Each Headteacher Run The Incident At Their Own School?
No. A headteacher should run the school's response, and the trust should run the incident. The belief that every headteacher manages the whole incident comes from guidance and plans written for single schools. Applied to a shared attack, it produces twelve plans, twelve messages to parents and nobody with authority over the systems the schools share.
It's an easy assumption to make. Headteachers are the senior person on site, and for a burst pipe or a fire alarm that settles it. A cyber attack on central IT is different, because the thing that failed isn't in the building.
Deciding who manages a cyber incident in a multi-academy trust doesn't take authority away from headteachers. It tells them which questions are theirs. Registers on paper, pupils safe, staff briefed, parents told: all of that stays with the school.
What Should A Cyber Incident Plan For Schools In A Trust Name In Advance?
A cyber incident plan for schools in a trust should name five things in advance: one incident lead, a deputy for every role, a contact list held outside the trust's systems, one owner for external reporting, and the single place where decisions are logged. Writing down who manages a cyber incident in a multi-academy trust takes about a page.
- An incident lead from the central team, often the chief operating officer, with authority the board has agreed.
- A deputy for every role. The DfE's checklist for getting a cyber response plan ready says to appoint deputies for all roles.
- A contact list that opens when email and the MIS are down. The same checklist says to print plans or save them in a format that can be reached in a cyber attack.
- One reporting owner for the insurer or RPA, Report Fraud and the DfE, who works with the data protection officer on any report to the Information Commissioner's Office (ICO).
- One timeline with a named record-keeper.
For RPA members, the membership rules for academy trusts dated September 2026 also make a cyber response plan a condition of cyber cover.
Then test it. Give the scenario to the central team and three headteachers and ask one question: who is in charge? If the answers differ, the plan isn't finished.
How Does Crises Control Support The Trust's Incident Lead?
Crises Control gives the trust's incident lead one workspace to run the incident from. Its Incident Manager module launches a predefined response plan, notifies recipient groups such as headteachers and the recovery team, and keeps a timeline of communications, updates and decisions. The workspace is cloud-hosted, away from the trust's own servers.
Trusts that search for Crisis Management Software are usually looking for that: one place to declare an incident, tell the right people and record what was decided. Message templates, recipient groups and attachments such as contact lists are set up in advance.
When the incident lead activates the plan, the platform alerts each group by SMS, voice call, email, push notification and Microsoft Teams, and shows who has acknowledged. Every communication, acknowledgement, update and decision is timestamped, and the record can be exported for trustees or the insurer.
Some things the software can't do. It records the answer to who manages a cyber incident in a multi-academy trust, but the board has to supply it, along with deputies and closure criteria. Someone has to keep the contact groups current. The platform doesn't contain the attack or restore the servers. And the judgement calls stay with named people: open or closed, what to tell parents, when to report.
The School Emergency Management Software page describes how the platform is used from a single school up to a multi-academy trust. One secondary school with more than 1,200 pupils now uses customised response plans on the platform, as its case study describes.
Trust Cyber Incident Roles Checklist
This checklist turns the question of who manages a cyber incident in a multi-academy trust into eight things a board can check.
- The board has named one incident lead for trust-wide incidents, and a deputy.
- Every headteacher knows which decisions are theirs and which go to the incident lead.
- The criteria for opening, part-opening or closing a school are written down.
- One person reports to the insurer or RPA, Report Fraud and the DfE sector cyber team, and the data protection officer owns any report to the ICO.
- One approved line for parents exists, and each school adds only its own details.
- Every school has a designated safeguarding lead or deputy on site, and the incident lead can see that.
- The plan and the contact list can be opened when the trust's systems are down.
- Decisions go into one timeline, kept by a named record-keeper.
One Incident, One Lead, Twelve Schools
Go back to 07:40. Twelve headteachers have started twelve responses because nobody told them not to. None of them is wrong to act. They just don't know who else is acting.
A trust that has settled who manages a cyber incident in a multi-academy trust looks different at the same minute. The incident lead has declared it. Every headteacher has one message saying what is affected, what to say at the gate and when to report back. The central team answers each question once.
Getting there doesn't start with technology. It starts with a board decision, a page of roles and a test on a quiet afternoon.
For the next step, read how schools reach parents when the MIS and email are down, see what Incident Manager records during a live incident, or look at how one secondary school set up its response plans.
Frequently Asked Questions
Who manages a cyber incident in a multi-academy trust?
Who manages a cyber incident in a multi-academy trust depends on what is affected. When the attack reaches shared systems, the trust should manage it through one named incident lead with a deputy, and each headteacher runs the response in their own school and reports to that lead. The split works only if the trust agreed in advance which decisions sit at which level.
What are the main multi-academy trust incident response roles?
The main multi-academy trust incident response roles are an incident lead, a deputy, a technical lead, a communications lead, a reporting owner, the data protection officer and a record-keeper. In each school, the headteacher and the designated safeguarding lead (DSL) hold the on-site roles. Department for Education (DfE) guidance written for single schools calls the coordinating role the senior leadership team (SLT) digital lead.
Is a trust-wide plan better than a cyber incident plan for each school?
A trust needs both, because the two plans do different jobs. The trust-wide plan says who runs the incident, who reports it and what parents are told, while each school's plan covers registers, safeguarding and opening on the day. A cyber incident plan for schools that share systems should point to the trust plan for anything that affects more than one school.
Can a multi-academy trust pay a ransom after a cyber attack?
No. As at October 2026, the Academy Trust Handbook 2026 says trusts must not pay any ransom or extortion demands, including cyber ransomware. The handbook, effective from 1 October 2026, adds that payment has no guarantee of restoring access or services and is likely to result in repeat incidents. School groups in other countries should check the rules that apply to them.
What does crisis management software do during a cyber incident?
Crisis management software gives the people running an incident one place to declare it, alert the right groups and record what was decided. A cloud-hosted platform sits outside the organisation's own email and servers, so it doesn't depend on them. Crises Control's Incident Manager launches predefined response plans and keeps a timestamped incident timeline.
This article was drafted with AI assistance and reviewed by the Crises Control team. Featured image: AI-generated.
