Student and research data
Cyber attacks and data protection duties.
How we help: ISO/IEC 27001 and ISO/IEC 27701 for security and privacy.
Industry
Education
Universities, schools and training providers hold large amounts of personal and research data, run complex estates and operate laboratories. We build management systems that protect people and data and support research credibility.
Challenges we solve
Pressures on education providers
Data breaches, campus safety, research integrity and AI in teaching.
Campus safety
Laboratories, workshops and events.
How we help: ISO 45001 for staff, students and contractors.
Estate management
Large, ageing campuses.
How we help: ISO 41001 facility management and ISO 50001 energy.
Research laboratories
Credible, accredited testing.
How we help: ISO/IEC 17025 accreditation readiness.
AI in teaching
Responsible use of AI tools.
How we help: ISO/IEC 42001 AI governance.
Records
Student and research records retention.
How we help: ISO 30301 records management.
Recommended standards
Standards for education providers
Core standards first, then the additions your customers, regulators or risks call for. Most run as one integrated management system.
ISO/IEC 27001
Information security.
Core ISO/IEC 27701Student and staff privacy.
Core ISO 45001Campus health and safety.
Core ISO 41001Estate and facility management.
ISO/IEC 17025Research and testing laboratories.
ISO 50001Campus energy.
ISO/IEC 42001AI governance.
ISO 9001Training and service quality.
Regulatory context
Requirements that shape your system
Management systems help you meet these obligations and show evidence of control. They do not replace the obligations themselves.
Data protection
Data protection law for students, staff and research participants.
Safety law
Occupational safety law covering staff, students and contractors.
Research integrity
Funder and regulator expectations for research data and laboratories.
Safeguarding
Duties to protect students, particularly minors.
Which requirements apply depends on your jurisdiction and activities. We map your system to the ones that apply to you.
How we work with education providers
One partner, gap to certificate
01
Consultancy
Gap assessment, implementation and integrated systems built around how education providers operations really work.
02Certification support
Certification body selection, mock audits and Stage 1 and Stage 2 support.
03Training Academy
Awareness to CQI/IRCA Lead Auditor, in-house or public.
04Ongoing partnership
Outsourced internal audit, management review and 2026 transitions.
Training Academy
View the Training Academy
Training for education providers teams
CQI/IRCA Approved Training Partner. Awareness, Implementer, Internal Auditor and Lead Auditor courses, in-house, public, virtual or hybrid.
Popular courses for this sector: ISO/IEC 27001, ISO/IEC 27701, ISO 45001, ISO/IEC 17025.
Questions
Education FAQ
Does AEC issue the certificates?
No. Certificates are issued by independent certification bodies accredited by UKAS, DAkkS or an equivalent national accreditation body, or by the scheme-specific bodies some standards require. AEC prepares your organisation for those audits.
Can a university certify only part of its operations?
Yes. Scope can be limited to central IT, a faculty, a research institute or a laboratory.
Is there an education-specific standard?
Organisations often start with ISO/IEC 27001 and ISO 45001. We can advise on sector-specific options during the gap assessment.
Plan your education management system
Tell us your campuses, data and laboratories. We reply with a proposal covering implementation and certification support.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.