How to choose a school management system: requirements, demo questions and a checklist
How to choose a school management system or MIS without being won over by the smoothest demo: the requirements a headteacher, business manager or trust should write down first, from data protection and the DfE's standards to census returns, contract and exit, with demo questions, red flags and a checklist to print.
If you are working out how to choose a school management system, start with a list, not a shortlist. Write down what the system must do, who will use it, which statutory returns it must produce and what your data protection officer needs to see, then ask every supplier the same questions. In England much of that list comes from the Department for Education: the MIS produces the school census and the common transfer file, and since July 2026 the DfE's Core Principles for MIS procurement add rules on security accreditation, contract length and getting your data out. Below: ten requirements, demo questions, red flags and a checklist to print.
This MIS buyer's guide is vendor-neutral; the systems themselves are in our school management system comparison. In England the system is called the MIS; international and American schools often say school management system or student information system.
Before you talk to vendors
Form a small group early: senior leadership, the business manager, the data manager, the timetabler, a class teacher, your data protection officer and, in a trust, central IT and finance. List what you use today and what the new system replaces. Mark each requirement must or could: a bid that misses a must is out, however good the demo.
How to choose a school management system: ten requirements
1. The jobs it must do
The DfE names an MIS's core functions as census data collection, pupil data, pupil relationship mapping, admissions and transfers, attendance, and the mandatory reporting for pupils with special educational needs and looked-after children. Then add what else you need, and ask whether unused modules can be switched off and whether you still pay for them.
2. Census, statutory returns and CTFs
State-funded schools in England submit the school census three times a year, as XML built to that year's DfE specification, and send a leaving pupil's record on as a common transfer file (CTF); CTF 26 is valid from September 2026. Ask whether the system produces both, how quickly it follows each year's changes and who helps with validation errors. Registered independent schools make a school-level return (SLASC) instead; international schools outside the UK have no DfE returns. More in our post on the MIS and the school census.
3. Data protection
The school or trust is the controller; a supplier holding pupil data for you is a processor. Article 28 of the UK GDPR requires a written contract under which the processor acts only on your documented instructions, secures the data, uses sub-processors only with your written authorisation, helps you answer people's requests to exercise their rights, such as subject access requests, and deletes or returns the data at the end. The DfE's data protection guidance for schools adds questions for EdTech suppliers: why each kind of data is needed, which sub-processors are involved, where data is stored, which certifications they hold and what any AI does with pupil data. Where the processing is likely to result in a high risk, you must complete a data protection impact assessment (DPIA).
4. Security and the DfE's standards
Of the DfE's digital and technology standards, the cyber security standard says multi-factor authentication must be enabled for all staff accounts with access to cloud services, and that accounts are disabled as soon as someone leaves. The cloud solutions standard asks for data stored in the UK or EU unless any transfer complies with UK GDPR, and for your data back "in an open standard or neutral format" at the end. The Core Principles add that an MIS supplier must hold Cyber Essentials Plus and/or ISO 27001, or be working towards it with completion by spring 2027 at the latest. Ask for the certificate or the date.
5. Roles, permissions and single sign-on
The class teacher sees their class, the office the whole school, a parent only their own children. Ask how finely rights can be set, whether they are enforced on the server or only hidden on screen, and whether changes are logged. The cloud standard asks for one centrally managed account with one log-in per user: ask whether staff can sign in with Microsoft or Google. A trust needs a view across its schools.
6. Communication with parents
Parents report absences, read letters, give consent, book parents' evening and pay for trips. Ask whether they need an app or a browser is enough, whether each parent gets their own log-in, whether log-ins cost extra and how you reach families without a smartphone.
7. Accessibility
The public sector accessibility regulations largely exempt school websites and apps, but not the content people need to use the school's services; gov.uk's example is a form for school meal preferences. A parent portal for absences and consents is close to that example, and the government names WCAG 2.2 AA as the standard. Ask for the supplier's accessibility statement, as the DfE's accessibility standard advises; one that lists known barriers says more than a badge.
8. Data in and data out
Ask what the supplier imports from your MIS, CTFs and spreadsheets, what does not come across, whether you see a preview before saving and who does the work at what price. Then ask what you get out. Under the Core Principles your data is available at any time at no extra cost; bulk transfers up to three times a contract year and at exit are free, by download or API, in a machine-readable, migration-ready format; and systems are API-enabled for sharing with other schools, EdTech providers and the DfE.
9. Support, contract term and exit
Ask how support is reached and when, whether training is included and what availability is promised. For MIS contracts signed before the DfE's MIS framework launches (expected on 1 September 2027; the Core Principles page itself still says June 2027), the Core Principles set the bar: no longer than three years including any renewal; automatic renewal once only, for at most twelve months, with the supplier contacting you at least six months before expiry; no agreement by clickwrap or portal acceptance; and a separate support contract ending with the MIS contract. For a maintained school they are guidance; an academy trust that re-procures before the launch must include them in its requirements (Academy Trust Handbook 2026, paragraph 2.30). For any other system holding pupil records they are a fair yardstick.
10. Total cost over the term
Price the whole term, not the first year. The Core Principles ask for pricing that shows the core provision, optional modules and every third-party integration before you sign; ask every supplier for the same breakdown so the bids can be laid side by side. Pricing models, the costs a price list leaves out and worked examples are in our post on what a school management system costs.
Questions to ask in a demo
Send two or three of your own workflows in advance to be shown, then ask:
- What does a class teacher see, and what not?
- Can you make this year's census return and a CTF now, and fix a validation error?
- How does our MIS export come in, and what is lost?
- How does a parent report an absence on a phone, and where does it land?
- Which of your staff can see our data, and would we know?
- Where is our data stored, and which sub-processors touch it, AI included?
- What do we get at the end, in which format, and what is left out?
- What does it cost over three years for our pupil numbers, everything included?
Red flags
- Data protection papers only after signature. They belong before the decision.
- A label instead of evidence. "GDPR-compliant" on a slide replaces neither the contract nor your own assessment.
- No test with your own data. A demo school does not show whether your export arrives clean.
- No way out. An export only as PDF, only for a fee or with no list of what is missing.
- Agreement by click. The DfE's commercial guidance warns that users "may not realise they are agreeing to changes" to a contract's terms, for example by clicking through.
A checklist to print
Give each bid a column. A point is met only when the evidence is in your hands.
| Area | What to check | Evidence |
|---|---|---|
| Jobs | Every must covered; unused modules can be switched off | Demo of your workflows |
| Census and CTF | This year's census and CTF, or a route to the system that makes them | Sample return |
| Data protection | Contract covering UK GDPR Art. 28(3); sub-processors; data location; AI | Documents before the decision; your DPIA |
| Security | MFA for staff; leavers' accounts closed; Cyber Essentials Plus or ISO 27001, or a date | Certificate |
| Roles and sign-in | Rights enforced on the server; change log; Microsoft or Google sign-in | Demo, list of roles |
| Parents | Browser or app; a log-in per parent; cost | Demo on a phone |
| Accessibility | WCAG 2.2 AA named; known barriers listed | Accessibility statement |
| Data in and out | Sources and preview; export formats, what is missing, exit | Test import, sample export |
| Contract and support | Term, renewal, notice, price changes, support hours | Draft contract |
| Total cost | Every item over the whole term | Written quote |
How Bildena answers the requirements
Bildena is new on the market, and the company, Bildena GmbH i. Gr., is still in formation. Below is only what can be checked in the product and its terms.
What it does not do. Bildena produces no school census return and no CTFs, and has no direct connector to Arbor, SIMS or Bromcom: data comes across as a CSV or Excel export, columns matched on screen, with a preview before saving. A state school in England keeps its MIS for statutory returns and runs Bildena School beside it, or uses Bildena Scheduler for the timetable alone. Bildena holds no Cyber Essentials or ISO 27001 certification today and offers no documented API for other systems.
Data protection and sign-in. A data processing agreement (Art. 28 GDPR) is signed at the start; data is hosted in German data centres, inside the EEA, which UK law treats as adequate. AI is off by default and only a school administrator can switch it on; who switched it and when is recorded. When it is on, the question and the data the answer needs go to Google Cloud Vertex AI in Frankfurt, with pupils shown only as P-numbers. Fields a school does not need, such as health, religion or photo, can be switched off. The school's administration sees each time Bildena staff open the school's data: one line per person, area and hour, with any reason given. Staff sign in with Google or Microsoft, or with a password plus two-factor codes from an authenticator app, which the school can make compulsory. The data protection pack is on request.
Roles and families. Rights are set per role and screen, and per reach (whole school, classes taught, classes led), enforced on the server; changes are logged with who and when. A trust sees several schools in one view. Families use Bildena in the browser, also on a smartphone, and see only their own children: absences, letters, consents, messages and parents' evening. Log-ins are free and unlimited. The accessibility statement claims partial conformance with WCAG 2.1 AA, not yet 2.2, and lists known barriers.
Data out, contract and cost. Subjects, teachers, classes, rooms, students and lessons export as Excel or CSV, the timetable in Untis or aSc format; availability, rules and user accounts are not in the file. Support is by email in English, German and French. The subscription renews for the term you chose and can be cancelled in the product to its end; price changes come at least three months ahead. After the contract, data is kept 90 days, then deleted. The price is published: Bildena School costs €5 per student a year, at least €1,000 a school, with every module, plus VAT where it applies; prices are set and invoiced in euros.
Frequently asked questions
What should an MIS requirements checklist include?
First the points a bid can fail on: census and CTF in England, data protection documents, MFA and certification, roles and sign-in, a usable export and the cost over the term.
Do the DfE's MIS Core Principles apply to us?
They cover new MIS procurements until the DfE's MIS framework launches, not existing contracts. For maintained schools they are guidance; academy trusts that re-procure before the launch must include them (Academy Trust Handbook 2026, paragraph 2.30). Once the framework is in place, contracts longer than three years will be possible.
Can we use real pupil data in a trial?
Only once a data processing agreement is in place and your data protection officer agrees. Until then, a demo school will do.
How long does choosing a new MIS take?
Allow several months for demos, a trial and the contract, more for a formal tender. The six months' notice the Core Principles ask suppliers to give before expiry is the latest sensible point to begin.
Check the requirements yourself: in the free month you try Bildena School with every module and your own school's data, no card needed.
