MFA by 2026: How Vita MAT Beat the Cyber Essentials Deadline

Vita Multi Academy Trust (formerly The Perins MAT) needed a multi-factor authentication solution that could work for Year 3 pupils — without creating new burdens for teachers or the IT team. With Clever’s deviceless Classroom MFA, they achieved Cyber Essentials compliance ahead of the April 2026 deadline and reduced IT support tickets across the trust.

Vita Multi Academy Trust (MAT), formerly The Perins MAT, is a UK multi-academy trust serving over 1,250 pupils and staff across multiple schools spanning primary and secondary key stages. Phil Segal, the trust’s Chief Information Officer, oversees a digital environment built on Microsoft Entra ID and Arbor MIS — a combination that reflects the complexity many UK trusts navigate every day.

The Challenge: Security That Works for Every Age Group

Vita needed to implement multi-factor authentication for pupils, but mobile phones are banned in most UK schools. The challenge wasn’t whether to add MFA, but how to do it in a way that wouldn’t disrupt classroom time or pile on to the IT team’s workload.

At the same time, UK schools were facing converging compliance pressures: the DfE’s 2030 Digital Standards trajectory requires MFA as a cybersecurity baseline, and the Cyber Essentials update introduced an MFA requirement for cloud services (A6.4, A6.5) effective April 2026. Doing nothing wasn’t an option.

The Solution: MFA That Works for All Ages

To comply with the Cyber Essentials requirement ahead of the April 2026 deadline, Vita partnered with Clever to deploy Classroom MFA — a deviceless multi-factor authentication solution designed specifically for K-12 environments. Unlike enterprise MFA tools that assume every user has a personal mobile phone, Clever’s Classroom MFA offers 8+ authentication methods, including deviceless options, tailored to different age groups and classroom realities.

Clever syncs data directly with Arbor MIS, creating a consistent identity layer across Vita’s Google Workspace and Microsoft Entra ID environments. From there, pupils authenticate using methods matched to their age and device:

• Clever Badges — a physical, encrypted passcode similar to a QR code that younger pupils scan in front of a webcam. No typing, no mobile required.
• Login pictures — an image-based selection method accessible for early-years learners and older pupils.
• PINs, biometrics, and hardware tokens — standard, configurable options for secondary pupils and staff.

Phil’s team took a phased approach: a 5-to-6-week proof of concept with a subset of users, followed by a full rollout and staff training program. This kept risk low and gave the team real-world data before committing trust-wide. Additionally, if a pupil lost a Badge or had a login issue, the classroom teacher could resolve it directly in the Clever Portal — no IT ticket needed, no lesson interrupted.

The Impact: Stronger Security, Less Disruption

Since rolling out Clever’s Classroom MFA, Vita has seen measurable improvements across security, operations, and the classroom experience.

Security

• Met the Cyber Essentials April 2026 MFA requirement for cloud services — ahead of schedule.
• Closed credential vulnerability gaps across Google Workspace, Microsoft Entra ID, and Chromebook devices.
• Reduced password-related IT support tickets — a clear sign the new process is working.

Operations & Learning

• Significant reduction in IT burden around password management — one of the most time-consuming recurring tasks for school IT teams.
• Teachers can manage student MFA directly, keeping classrooms running without IT involvement.
• No uptick in classroom disruption — learning time has been protected throughout.

Strategic

• Vita is now on track to meet the DfE’s 2030 Digital Standards, treating identity and access management as an ongoing foundation — not a one-time project.
• A scalable identity infrastructure is now in place as Vita continues to grow.