In short: Cisco Umbrella for schools provides DNS-layer web filtering that follows devices on and off site, including Chromebooks and staff laptops, with separate policies for staff and students and reports for safeguarding leads. Schools must satisfy themselves it meets DfE and UKSIC expectations, and it does not provide monitoring. Cisco stops selling Umbrella on 31 January 2027.
Why schools use Umbrella
Umbrella suits schools for the same reasons it suits businesses, plus a few that matter more in education:
- Everything on the network is filtered once the school's DNS points at Umbrella, including guest Wi-Fi and pupils' own devices, without installing anything on them
- Filtering follows the device home on school laptops and Chromebooks, which matters for homework devices and staff working remotely
- It is light to run: there is no filtering appliance to size and maintain in the web traffic path, and policy changes apply across every site at once
- Security comes with it: malware, phishing and command and control blocking protects school systems as well as pupils
The trade-off is that DNS filtering only sees domains, not individual pages or search terms. That is enough for much of what schools block, but not all of it. Our appropriate filtering for schools guide sets out what the DfE and the UK Safer Internet Centre expect and where extra layers are needed.
The building blocks of a school deployment
A typical school or college build combines several Umbrella components:
| Need | Umbrella component |
|---|---|
| Filter everything on the school network | Network identity with DNS forwarded to Umbrella (Umbrella DNS servers) |
| Know which pupil or member of staff made a request | Umbrella virtual appliance with the AD Connector, or cloud identity from Entra ID |
| Filter Chromebooks at school and at home | Cisco Security for Chromebook, with Google Workspace users and organisational units |
| Filter staff laptops off site | Umbrella Roaming Security Module in Cisco Secure Client (Umbrella roaming client) |
| Safer search results | SafeSearch enforcement for Google, YouTube (Restricted Mode) and Bing |
| Page-level control and HTTPS inspection | Intelligent proxy for risky domains (DNS Security Advantage), or the secure web gateway for all web traffic (SIG packages) |
Google Workspace integration is particularly useful for schools. It adds Google Workspace users and organisational units to Umbrella policy, so the same structure you use in the Google Admin console, such as staff, sixth form and lower school, can drive different filtering. Cisco recommends placing a Chromebook-specific policy at the top of the policy list so it is evaluated first. For privacy when Chromebooks are used away from school, Cisco also lets you turn off content logging for that policy and record only security events; weigh that against the DfE's expectation that filtering logs can identify the user, device and time.
Different policies for staff and students
The DfE expects schools to use different filtering profiles for different groups rather than one blanket setting. Umbrella handles this through identity-based policies evaluated in order:
- Create a students policy with stricter content categories, SafeSearch on and no bypass.
- Create a staff policy that allows teaching resources pupils should not reach unsupervised, such as video sharing or social media for marketing.
- Optionally add year-group or key-stage policies using AD groups or Google organisational units.
- Keep a strict Default policy for anything unidentified, such as guest devices.
- Order the policies from most to least specific and test each group with Umbrella's policy tester.
Time-limited bypass codes let a teacher unblock a specific site for a lesson; a code unblocks only the domain being requested, not the whole category. Use them carefully: the DfE expects the senior leader responsible for filtering to approve and document exceptions, with the designated safeguarding lead (DSL) assessing the safeguarding implications. The Umbrella content filtering guide covers block pages and bypass options in detail.
Reports for DSLs, IT and trusts
Umbrella's reports show which identities tried to reach which blocked categories, which is useful evidence for the DSL and for annual filtering reviews. Activity Search can be filtered by identity, destination, content category and security category, and reports such as Top Categories and Top Identities can be emailed daily, weekly or monthly. See Umbrella reporting for retention periods and log export.
Two honest limits: DNS logs record the domain, not the search term or page, even though the DfE standards say filtering logs should identify the search term or content blocked; and SafeSearch redirects do not appear in Umbrella reports. If your safeguarding approach depends on seeing searches or on-screen content, you need a proxy or monitoring product alongside DNS filtering.
For multi-academy trusts and college groups, the Umbrella multi-org console manages each school as its own organisation, with shared block lists and security settings, local admins per school and trust-wide summary reports.
What Umbrella does not do, and what we have not found
We want schools to buy with their eyes open, so here is what we can and cannot say:
- Umbrella filters; it does not monitor. The DfE filtering and monitoring standards treat monitoring as a separate, reactive activity: reviewing activity and alerting on concerns. Umbrella does not provide that.
- No compliance badge. We do not describe Umbrella as meeting or complying with KCSIE, the DfE standards or the UK Safer Internet Centre definition. Each school must satisfy itself, and we help you assess and configure it.
- IWF and CTIRU. Cisco Systems Inc appears on the Internet Watch Foundation's published list of members, and Cisco enforces its Child Abuse Content category globally. At the time of writing, Cisco is not listed among the UK Safer Internet Centre's accredited filtering providers or self-certified provider responses, and we have not found a public Cisco statement about the CTIRU list. Ask any provider, including us, for written answers to the DfE's IWF and CTIRU questions.
- Mobile data. Filtering applies where Umbrella is in the path. A pupil's own phone on mobile data is outside it.
As background, the DfE has published guidance on removing Umbrella from DfE-provided Chromebooks ordered before October 2021, whose licences were extended to 30 September 2022. That applied to those devices only and is not a statement about Umbrella generally.
Education versions, end of sale and how we help
Cisco sells Education versions of the Umbrella DNS and SIG packages. Like the commercial packages, they are covered by Cisco's end-of-life notice: end of sale on 31 January 2027, last renewal on 31 January 2028 and last date of support on 31 January 2029. Cisco names Secure Access DNS EDU Essentials as the migration product for DNS Security for Education, and Secure Internet Access Essentials for SIG for Education; the Education multi-org add-ons are on the same notice. See Umbrella end of life for what this means for your renewal.
Forever Systems works with schools, colleges and trusts on Umbrella deployments and reviews: staff and student policy design, Chromebook and Google Workspace integration, block page wording, reports for DSLs, and planning the move to Cisco Secure Access or an alternative before support ends. Contact us to arrange a filtering review.
Explore Umbrella for schools
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Cisco Umbrella KCSIE compliant?
No filtering product can be described simply as KCSIE compliant. KCSIE expects appropriate filtering and monitoring, and the DfE standards and UKSIC definition set out what that means. Each school must satisfy itself. We help schools assess how Umbrella is configured against those expectations and where other tools are needed.
Does Cisco Umbrella work on Chromebooks?
Yes. The Cisco Security for Chromebook extension gives DNS-layer protection for the whole Chromebook, at school and at home, and for SIG customers adds secure web gateway protection in the Chrome browser. It is deployed through the Umbrella dashboard and the Google Admin console.
Can Cisco Umbrella monitor what pupils do online?
Not in the sense the DfE means. Umbrella logs DNS requests and blocks, which helps with reporting, but it does not review on-screen activity, searches or messages, or raise safeguarding alerts. Schools need a separate monitoring approach.
Can teachers have different filtering from students in Umbrella?
Yes. Policies can be tied to Active Directory groups, Entra ID groups or Google Workspace organisational units, so staff, students and individual year groups can each have their own policy.
Can a school still buy Cisco Umbrella?
Until 31 January 2027, yes, and existing subscriptions can be renewed until 31 January 2028. Support ends on 31 January 2029, so any new purchase should come with a plan to move to Cisco Secure Access or another product.