The Closure Clause: Testing Cyber Cover Against a School's Real Exposure

A cyber incident becomes a governance matter at the point it stops the school from operating. That may mean admissions enquiries going unanswered, safeguarding records becoming inaccessible, payroll failing, or a boarding house losing its routine communications. At that point the board is no longer dealing with an IT outage. It is dealing with continuity, regulatory duty and reputational trust.

Cyber insurance has a role in that response, but a policy is not assurance in itself. The board's task is to establish whether the cover matches the school's operational exposure, whether the incident response plan is credible, and whether the school could evidence its decisions if challenged. The following route is designed for governors rather than technologists.

Begin with the school day, not the policy schedule

A board should first ask which services must function for the school to open safely and meet its obligations. Typical dependencies include the management information system, admissions and enquiry tracking, safeguarding and pastoral records, payroll and pensions data, fee collection, parent communications, timetable and cover arrangements, catering, transport and boarding systems.

For each dependency, governors should see four things: the system or supplier involved, the internal owner, the manual fallback, and the maximum tolerable period of disruption. That last measure is often missing. A school may tolerate a day without its parent portal; it may not tolerate a week without access to medical or safeguarding information. Once these tolerances are documented, the insurance policy can be read against something real rather than against a general sense of comfort.

Read the policy as a set of limits and conditions

Governors do not need to interpret every clause, but they should see the schedule, endorsements and principal exclusions. The useful questions are practical. Does the policy respond to ransomware and extortion? If ransom payment is covered, what conditions apply, what sanctions screening is required, and who authorises payment? Many policies meet response costs while restricting or excluding the ransom itself. The board should know which position applies and why.

Business interruption cover deserves similar scrutiny. Governors should ask what triggers the cover, whether there is a waiting period, how long the indemnity period runs, and whether the policy responds to denial of access or to failure of a critical supplier. A school may find that its own systems are restored quickly but that a payment provider or cloud host remains unavailable. Contingent business interruption cover, where purchased, should be tested against the suppliers that genuinely matter.

Sub-limits also matter. Forensic investigation, legal advice, public relations support and regulatory notification costs may each carry a cap. The board should see whether those caps are proportionate to the school's size and complexity, and whether the aggregate limit would still leave meaningful cover after a first incident. A policy that pays after closure but not during it is only partial assurance.

Notification duties are not delegated wholesale to the insurer

Under UK GDPR, a personal data breach may require notification to the Information Commissioner's Office within 72 hours of awareness. The school remains the data controller. Insurer panels and legal advisers can support the decision, but the board should know who decides, who records the decision, and how the school would demonstrate that it acted promptly.

The incident response plan should therefore identify decision rights. Who can instruct forensics? Who contacts the insurer? Who decides whether to close a building or suspend a system? Who speaks to parents, staff and the wider market? Who keeps the decision log? Governors should see the plan and evidence that it has been exercised, not merely adopted.

Supplier dependency is a board-level exposure

Independent schools rely on a small number of specialist suppliers for management information, payments, payroll, communications and cloud infrastructure. The board should ask for a supplier register that identifies critical providers, contractual notification periods, security assurances, exit arrangements and any evidence of the supplier's own continuity planning.

Insurance may not respond to a supplier's failure unless the policy expressly covers it. Even where cover exists, the school still needs a fallback. Governors should test whether the school could contact parents, pay staff and access essential records if a principal supplier were unavailable for a week. If the answer depends on the same supplier's portal, the dependency is not fully understood.

Run a short tabletop before renewal

A 90-minute exercise is usually enough to expose the gaps that matter. The scenario should be plausible and uncomfortable: ransomware detected on a Friday afternoon before an open morning, with the admissions system unavailable and concerns about personal data. Participants should include the head, bursar, designated safeguarding lead, IT lead, communications lead and a governor observer.

The exercise should test the insurer notification route, the closure decision, regulatory notification, parent communications, access to safeguarding information, payroll continuity and the board's own escalation. The output should be a short record of decisions, timings and gaps. That record is more useful at renewal than a general statement that cyber risk is taken seriously.

Questions for the board

• Which services must operate for the school to open, and what is the maximum tolerable outage for each?
• Does the policy cover ransom, extortion, business interruption and supplier failure, and on what conditions?
• What are the waiting periods, sub-limits and aggregate limits, and how do they compare with the school's exposure?
• Who decides whether to notify the ICO, and how is that decision recorded?
• Which suppliers are critical, and what evidence is there that the school could operate without them for a week?
• When was the incident response plan last exercised, and what changed as a result?
• Has the insurer's questionnaire been completed consistently with the school's actual controls?
• What would the board expect to see in the first hour, the first day and the first week of a significant incident?

Evidence the board should see

Governors should ask for the current policy schedule and endorsements, the latest insurer questionnaire, the incident response plan, the supplier register, the data map, the most recent tabletop report and the notification decision log. They should also see the renewal recommendation in plain English, showing what has changed and why.

The board does not need to become a cyber security committee. It does need to know that policy, plan and people align. A cyber policy should be tested in the same way as any other continuity instrument: against the school's real dependencies, its regulatory duties and its capacity to make decisions under pressure. The right time to test the closure clause is before the incident, and before renewal.