Raising the Standard: How Cyber Essentials Plus Protects Local Authority and Virtual School Data
We’re pleased to confirm that Welfare Call has once again achieved the Cyber Essentials Plus certification – the highest level of assurance within the government-backed Cyber Essentials framework.
This isn’t just another annual tick-box exercise. It’s a clear sign of our ongoing commitment to maintaining the highest standards in data security, privacy, and resilience for the Local Authorities, Virtual Schools, and education partners who trust us with sensitive information every single day.
What’s New This Year?
This year, the Cyber Essentials Plus framework introduced a brand-new question set codenamed ‘Willow’, designed to reflect modern security threats and new ways of working.
As Chris Johnson, our Data Protection & Compliance Manager, explains:
“Cyber Essentials has a new question set this year, codenamed ‘Willow’, that introduces significant updates to reflect modern working practices and security threats. This includes new requirements for home and remote working, passwordless authentication, a broadened definition of ‘vulnerability fixes’, and more detailed guidance on firewall management and device scope. Welfare Call (LAC) Ltd passed with flying colours – as in previous years – thanks to the efforts of our dedicated IT team working behind the scenes to make sure we’re ahead of the curve and using the latest technologies to ensure secure and resilient services for our clients.”
Why Cyber Essentials Plus Matters
Cyber Essentials Plus is more than just a certificate. It’s an independently audited standard that provides external validation that we’ve done the work, not just policies on paper, but practical implementation of strong controls that withstand real-world testing.
Here’s what it means for you:
- Peace of mind: You can trust that data on your vulnerable children, families, and educational settings is protected with robust, tested controls.
- Assurance for procurement: If you’re procuring services through G-Cloud or internal procurement teams, CE+ shows that we meet or exceed government expectations for security.
- Resilience against threats: The framework ensures that we can identify, defend against, and recover from cybersecurity incidents — meaning minimal risk to your operations.
- Confidence for collaboration: Whether it’s API integrations, data extraction via Wonde, or multi-agency reporting, you can be confident that the systems supporting your work are built securely from the ground up.
Designed for the Data You Handle
Virtual Schools and Local Authorities deal with highly sensitive personal data, especially when it comes to looked-after children, children in need, and those in alternative provision or SEND support. At Welfare Call, we don’t take that responsibility lightly.
Our systems are designed with safeguarding in mind and our approach to cybersecurity mirrors that. From encrypted transmission protocols and strict access controls to remote working best practices and zero-trust architecture, our tech stack supports the work you do, securely.
Ahead of the Curve
This year’s enhanced Cyber Essentials Plus requirements gave us the opportunity to re-evaluate and further improve our internal practices. That includes:
- Updating our password policies to accommodate passwordless authentication
- Strengthening protection for remote workers and endpoint devices
- Expanding internal monitoring and patch management for new device types
- Clarifying scope boundaries for firewall rules and access policies
The result? More robust systems for us, and more secure service delivery for you.
What Our Customers Can Expect
- Secure, scalable systems for attendance, attainment, safeguarding and PEP management
- Ongoing investment in best-in-class IT infrastructure
- Full alignment with national standards for public sector cybersecurity
- Expert technical support backed by a team that understands your world
Our Promise
We’re not just building software, we’re building trust. That trust is earned by doing the right thing behind the scenes, even when it’s invisible to the end user. Cyber Essentials Plus is one way we demonstrate that commitment in real terms.
If you’re reviewing your own internal data practices or planning a procurement process for a new digital partner and want to learn more about how our security measures align with your expectations, get in touch with your account manager.