In short
SASE for schools and multi-academy trusts brings web filtering, staff remote access and links between sites under one cloud policy. In England, the DfE's filtering and monitoring standards expect filtering on school-managed devices, including those taken off site, which agent-based SASE and DNS filtering can help with. Subscriptions can be billed monthly, terms confirmed at quote.
Get a quote for SASE for schools
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What the DfE filtering standards ask for
The Department for Education's filtering and monitoring core standard (opens in a new tab), part of "Meeting digital and technology standards in schools and colleges" on gov.uk, sets out its recommended approach to the statutory responsibility, under Keeping children safe in education, to have appropriate filtering and monitoring in place. As read on 9 November 2026 (the standard was last amended in September 2026, per its updates page (opens in a new tab)), the points most relevant to choosing a platform are:
- Filtering should be active, up to date and applied to all school or college-managed devices, including those taken off site, to unmanaged devices under a BYOD scheme and to guests
- Devices that are not school-managed should be on a separate virtual network
- The filtering provider should be a member of the Internet Watch Foundation (IWF), signed up to the Counter-Terrorism Internet Referral Unit (CTIRU) list and regularly updating blocklists; these blocklists must not be able to be disabled or altered by any user, including at multi-academy trust or local authority level
- No blanket profile: as a minimum, student and staff profiles with different levels of access
- Filter all internet feeds, including backup connections and portable Wi-Fi, and block technologies used to get around filtering, such as VPNs and proxy services
- Identify, as a minimum, the device name or ID and IP address (and where possible the individual), the time and date, and the search term or content blocked
- Review the provision at least once every academic year, and when working practices change, such as remote access or BYOD
Monitoring is a separate standard. The DfE describes filtering as preventative and monitoring as reactive: monitoring tools review user activity on devices and do not block anything, so a SASE platform's web filtering does not replace them. The DfE asks schools to check with each provider how its system meets the standards; we can help you gather those confirmations for the platforms you shortlist.
Where SASE helps a school or trust
SASE is not only a filtering product, but several of its parts line up with what schools need:
- Filtering that follows the device. An agent-based secure web gateway (opens in a new tab) or DNS filter applies policy to a school laptop at home as well as in the classroom, which is where off-site filtering often falls short.
- Different policies for different users. SASE and DNS filtering platforms apply policy by user or group, so student, staff and guest profiles can differ.
- Remote access for staff. ZTNA gives staff access to the management information system, finance and file shares from home without a full VPN.
- Joining sites together. SD-WAN connects trust schools and a central office, with failover between links, and can send each site's traffic through the same policy.
- One console for the trust. Central policy with school-level variations, rather than a separate filter in each building.
For DNS-layer filtering specifically, our sister sites cover web filtering for schools (opens in a new tab), including protective DNS, and Cisco Umbrella for schools (opens in a new tab).
Multi-academy trusts: one policy across many sites
A multi-academy trust often inherits a different firewall, filter and broadband contract with each school that joins. The DfE standard asks trusts to check filtering across "locations and different sites if there are buildings, schools or colleges on different premises", and to make sure user groups filter the correct content for students, staff and guests. Moving to SASE lets a trust standardise:
| Area | Typical position before | With SASE and SD-WAN |
|---|---|---|
| Web filtering | A different filter at each school, often only on site | One trust policy with school and year-group variations, applied on and off site |
| Staff remote access | Separate VPNs per school, or none | Per-application ZTNA to trust and school systems |
| Links between sites | Point-to-point VPNs or a mix of broadband and leased lines (opens in a new tab) | SD-WAN with failover, managed centrally |
| Reporting for safeguarding leads | Different reports from each filter | Central logs filtered by school or group, for the DSL and IT support to review |
| Joining a new school | New hardware and configuration | Add the site and users to existing policy |
A phased move works well for trusts: start with the central team and one school, then bring each school across at a natural break, such as the end of a broadband or filtering contract. The phased plan is on SASE implementation.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
SASE platforms for schools and trusts
Platforms we supply that fit schools and trusts include:
| Platform | Relevant parts | Read more |
|---|---|---|
| Cisco Secure Access (opens in a new tab) and Cisco SASE | Secure web gateway and DNS-layer security, ZTNA, with Cisco or Meraki SD-WAN for sites | Cisco SASE |
| Check Point SASE (opens in a new tab) | Internet Access with on-device, in-browser and cloud protections, Private Access and SD-WAN | Check Point SASE |
| Barracuda SecureEdge | Web security, ZTNA, firewall as a service and Secure SD-WAN, with inspection in the cloud, at the site or on the device | Barracuda SecureEdge |
| Sophos Workspace Protection | Sophos Protected Browser, Sophos ZTNA and DNS Protection for endpoints | Sophos SASE |
| Cisco Umbrella or DNSFilter | DNS-layer filtering alongside or before a full SASE platform | Web filtering for schools, linked above |
Facts are from each vendor's own site, checked 9 November 2026 (checkpoint.com (opens in a new tab), barracuda.com (opens in a new tab), sophos.com (opens in a new tab); Cisco on our Cisco SASE page). Which one fits depends on your existing firewalls and devices, how many schools you have and whether you need SD-WAN now. Endpoint protection is a separate layer; see antivirus for schools (opens in a new tab) on our sister site.
How Forever Systems helps schools and trusts
We can review your current filtering, remote access and links between sites against the points in the DfE standard, help your designated safeguarding lead and IT support compare platforms, and gather the provider confirmations the standard asks you to check. We can then quote, pilot at one school and roll out across the trust, and support the platform afterwards, with scope confirmed at quote. Subscriptions can be billed monthly, terms confirmed at quote. Contact us to talk about SASE for your school or trust.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
Can SASE be used for school web filtering?
Yes, many SASE platforms include a secure web gateway and DNS filtering that apply policy by user group, on and off site. Check with each provider how it meets the DfE filtering standard, including IWF membership, the CTIRU list and the logging the standard asks for.
Do the DfE standards require filtering on devices taken home?
The DfE filtering and monitoring standard says filtering should be applied to all school or college-managed devices, including those taken off site, as well as to BYOD devices and guests. Agent-based SASE and DNS filtering can apply policy wherever the device connects.
Does SASE replace a school's monitoring software?
No. The DfE describes filtering as preventative and monitoring as reactive. Monitoring tools review activity on devices and generate alerts; SASE web filtering blocks content but does not replace them.
Is SASE a good fit for multi-academy trusts?
Often, yes. A trust can apply one filtering and access policy across all its schools, with variations by school and year group, connect sites with SD-WAN, and add new schools to existing policy rather than installing new hardware.
How is SASE for schools licensed?
Usually per user, per device or per site, depending on the platform and component. Subscriptions can be billed monthly, terms confirmed at quote; some trusts prefer an annual term to match the academic year.
Still have a question about SASE for schools?
Ask us and a member of our team will get back to you.
More SASE guides
Cisco SASECisco Secure Access with Cisco SD-WAN or Meraki SD-WAN, explained.
Sophos SASESophos Workspace Protection: browser, ZTNA and DNS protection for endpoints.SASE for small businessWeb security, zero trust access and cloud firewall for small teams, without branch hardware.