Each spring, school and college IT teams across the UK join in the same high-stress ritual: sourcing, preparing and locking down enough secure devices for digital assessments. With major awarding bodies such as AQA, Pearson Edexcel, OCR and City & Guilds all driving the expansion of digital options for both mock and formal examinations – alongside rising demands for SEND access arrangements – network leaders need a deployment framework to bring secure assessment devices online faster, cheaper and with zero operational risk.
What is the JCQ mandate for technology in assessments?
The Joint Council for Qualifications sets strict, non-negotiable boundaries in its annual Instructions for Conducting Examinations (ICE) handbook.
As an IT leader, failing a surprise centre inspection or allowing an unmanaged device into the room is officially categorised as institutional malpractice, which can result in candidate disqualification.
To satisfy a JCQ inspector, your digital assessment deployment must completely bulletproof the following four technical risk areas:
- System-Wide Assistive Lockdown (JCQ ICE 14.20): Word processors used in examinations must have predictive text, automatic spelling and grammar check tools completely deactivated, unless explicitly approved as a candidate access arrangement.
- Total Network Isolation (JCQ ICE 14.21): Devices must be strictly blocked from accessing an intranet, the wider internet, or any unauthorised communication or data source during the exam.
- Complete Data Sanitisation (JCQ ICE 14.25): Candidate devices must be thoroughly cleared of any previously stored local data before the assessment begins. No data must remain accessible on the hardware after the exam session closes.
- Peripheral Security (JCQ ICE 14.22): The infrastructure must prevent unauthorised data leakage or inputs via external ports, such as rogue USB flash drives containing revision notes or secondary monitors hidden from the invigilator’s view.
The solution is already sitting in your storage cupboard.
Here’s your step-by-step operational blueprint to resurrecting your institution’s old laptops into a secure, Joint Council for Qualifications (JCQ) compliant assessment fleet using ChromeOS Flex.
1. Audit your storage cupboard
Almost every educational institution is sitting on a hidden, under-utilised asset: old laptops too slow for modern classrooms.
- The stack of DfE-funded laptops left over from the pandemic.
- End-of-life Windows 10 devices blocked from the Windows 11 upgrade.
- Machines that look pristine but take 10 minutes to log in.
If the screen works, the keyboard is intact and the battery retains a reasonable charge, the device is a prime candidate for a new lease of life with ChromeOS Flex.
2. Device re-certification triage
Your next step is to check that your recovered devices meet the minimum requirements for ChromeOS Flex. Thanks to the cloud-first architecture, eliminated bloatware and enhanced energy efficiency of ChromeOS, you will find that your institution’s prior IT investment won’t go to waste.
Google curates a regularly updated, official Certified Model List from a broad range of manufacturers. You can also Download ChromeOS Flex for free to set up a test boot drive and verify how it performs on your own hardware before committing to a permanent installation.
Here’s a handy table outlining what to look for in your sourced devices:
| Component | Minimum Assessment Threshold | Pass / Fail Action |
| Memory | 4GB RAM | PASS: Perfect for multi-tab cloud testing environments. |
| Processor | Standard x86-64 bit architecture (Intel or AMD) | PASS: ChromeOS Flex strips away the legacy OS bloat instantly. |
| Battery | Retains a minimum 2 to 3-hour active charge | FAIL: Mark as a desk-bound/plugged-in only device rather than scrap. |
| Connectivity | Working internal Wi-Fi chip and 1 functional USB port | PASS: Mandatory for cloud exam streaming and initial imaging. |
3. Prepare for device management
ChromeOS Flex devices are managed in the exact same way and in the exact same place as any native Chromebook: via the Google Admin Console. In order to properly prepare your selected laptops for secure assessments, a Chrome Education Upgrade is required.
This management licence (costing approximately £30 from a reputable Google Partner such as Getech) unlocks over 500 device, user, network and app policies that can be set-and-forget for your specific use case. The licence is per-device, not per-user, meaning multiple students can share a laptop across an exam cycle without incurring additional costs.
To get started, create a dedicated sub-Organisational Unit (OU) strictly for your exam devices, then configure these essential policies to guarantee compliance:
| Policy | What it does | Exam-ready Setting |
| Auto-launch app (Kiosk Mode) | Forces the machine to bypass the standard login screen and boot directly into a single, isolated assessment application on startup, blocking access to the rest of the OS. | Select your assessment app |
| Managed guest sessions | Enables a secure, shared logging-in profile without requiring a unique Google account. Multiple students can use the same device sequentially with total privacy. | Change to “Allow managed guest sessions” |
| Ephemeral mode | Operates a completely stateless browser environment, destroying all temporary files, download directories and clipboard history on session logout. | Change to “Erase all local user data” |
| Spelling control | Completely deactivates native auto-correct, predictive text and spellcheck tools system-wide, ensuring students receive zero linguistic assistance. | Change to “Disable spellcheck” |
| External storage devices | Blocks the operating system from reading or writing to external USB drives, SD cards, or external hard disks, stopping data leaks or illicit notes. | Change to “Block external storage devices” |
| Device display settings | Hard-locks the device to its primary internal monitor, blocking video outputs from projecting to secondary displays or capture cards. | Toggle off “Allow external displays” |
4. Mass deployment and provisioning
With your Google Admin Console policies configured and your Chrome Education Upgrade purchased and ready to apply, you are ready for the physical conversion of your selected hardware. Because ChromeOS Flex installs in minutes, a small IT team can easily transform an entire room of legacy laptops in a single afternoon.
Step 1: Create your master installer (10 mins)
Use the Chrome Recovery Utility extension on a working computer to flash the ChromeOS Flex image onto a high-quality USB drive.
Step 2: Boot and erase legacy bloat (2-5 mins)
Insert the master USB into your target legacy laptop. Power it on while tapping your manufacturer’s boot menu key (e.g. F12 for Dell, F9 for HP) and select the USB drive. When the installer loads, click Install ChromeOS Flex to completely wipe the old Windows OS and local storage.
Step 3: Trigger enrollment (1 min per device)
Once the installation finishes and the device restarts to the initial setup screen, do not log in. Instant, immediately press the keyboard shortcut Ctrl + Alt + E. This brings up the formal ChromeOS enrollment screen.
Step 4: Lock down the Exam OU (1 min per device)
Enter your school’s admin credentials to enroll the hardware. If you have configured your Google Admin Console to auto-place new devices, it will instantly drop into your restricted Exam OU. The laptop will pull down your kiosk mode configuration and strict policies immediately.
What happens in the event of a JCQ inspector audit?
If you have followed our blueprint this far, you now have a fleet of resurrected devices that are ready for exam day. Within 10 seconds of a student pressing the power button, the ChromeOS Flex device will immediately launch into your chosen secure assessment application. The student is locked out of the operating system, has no access to the URL bar and cannot use shortcuts to trigger background utilities.
If a JCQ inspector walks into your examination hall, because your fleet is centrally managed via the Google Admin Console, you have an unarguable audit trail ready to print. At any moment, you can generate a live policy snapshot for that specific OU, which will instantly show an inspector that Spelling control is disabled and External storage devices are blocked at the server level.
What else can ChromeOS Flex devices be used for outside of exams?
Your new fleet of ChromeOS Flex devices doesn’t have to gather dust until the next assessment season. Your management licences allow you to temporarily pivot these assets to solve other chronic operational headaches across the school year.
- Dedicated SEND Accessibility Hubs: Move selected devices into a temporary sub-OU where native accessibility features such as Select-to-Speak or Screen Magnifiers are permanently locked on for distraction-free, specialist workstations for students who require extra support.
- Library Loaner System: Re-route the laptops to a Managed Guest Session profile. Students can use them for quick research without waiting for a Windows device to boot up, eating into valuable research and learning time. The moment they log out, the stateless architecture destroys all residual user data, leaving it fresh and secure for the next student.
- Open Day & Enrollment Terminals: Lock the devices down to a single enrollment or visitor sign-in URL, preventing public tampering with internal school networks.
Looking for more guidance about implementing ChromeOS Flex to revive your old hardware? Contact our experts via the short form below and a member of the team will be in touch shortly.
