Cyber Security Standards

Schools should actively manage cyber risks through strategy, oversight and regular assessment.

Cyber security is a fundamental requirement for all schools and colleges, with clear expectations set out in the Department for Education’s (DfE) digital and technology standards.  The risk of disruption, data loss and safeguarding breaches resulting from cyber incidents continues to increase and remains a risk. Schools must therefore demonstrate robust technical controls, strong leadership oversight, clear risk management processes and carryout regular termly reviews.

A cyber risk assessment must be completed annually and reviewed every term. This assessment should identify where sensitive data is held, how systems are accessed, and the risks arising from teacher and staff behaviour, device usage and third-party suppliers. Findings must be recorded in a live risk register and fed into the school or colleges wider digital strategy and business continuity planning.

Effective cyber risk management requires collaboration across each school, MAT or college. IT support teams, safeguarding leads, data protection officers, school business professionals and senior leaders all have a role to play. Overall accountability sits with the SLT digital lead, who is responsible for coordinating the assessment process and ensuring agreed actions are implemented. Where IT services are outsourced, schools must ensure providers meet these standards and can evidence their own cyber resilience, i.e Cyber Essentials Certified.