Moving a school management information system to the cloud is now close to standard practice, but "cloud-based" on its own tells a school almost nothing about how secure that hosting actually is. Two vendors can both describe their product as cloud-based while differing significantly in hosting location, certification and the practical protections behind the marketing term. Due diligence needs to go past the label.

The licence fee is the number on the quote. The total cost of ownership is the number a school business manager actually has to plan for, and the two are rarely the same. Before signing for any school management information system, it pays to map every cost across the full contract, not just year one.

The cheapest headline price often is not the cheapest system to own. Ask for every cost in writing, model the full term, and compare providers on the total rather than the quote. That is the figure governors will ask about, so bring it to the table first.

Any vendor claiming ISO 27001 or PCI-DSS Level 1 certification, Compass Education included, should be able to produce current, dated certification evidence on request rather than a general assurance statement. A useful due diligence exercise is to ask every vendor on a shortlist for that evidence side by side. A vendor that can produce an up-to-date certificate on request has clearly built the audit process into how it runs the business; one that cannot has usually not been through that audit at all.

None of this needs to become an exhaustive audit for every school, Helping Learning Thrive but a business manager or IT lead signing off on a cloud MIS contract should be able to answer, with evidence rather than assumption, where data is hosted and which certifications back that hosting. That is the baseline, not an optional extra.

Parent engagement is the third pillar. Families now expect timely notices, simple payments and clear messaging. Look for an MIS that gives parents one app for updates, consent forms and account balances, rather than three disconnected tools that create more questions for the office.