School Cybersecurity Requirements in the UK: What England Expects

Schools in England have no single “cyber law”, but three layers of expectation apply: a statutory safeguarding duty that includes appropriate cyber security, data protection law, and the DfE cyber security standards that schools and colleges should be working towards meeting by 2030. If you run a school, a trust or a college, the practical task is to turn those expectations into evidence: a risk assessment, a tested response plan, controlled accounts and clear ownership. This guide sets out what each layer asks of you and where outside expertise, such as an independent IT security audit, makes the work faster to finish and easier to defend.

TL;DR

• The DfE cyber security standards are part of its Digital and Technology Standards. Schools and colleges in England should be working towards meeting them by 2030.
• The legal anchor is the statutory guidance Keeping children safe in education (KCSIE), which expects appropriate cyber security measures, plus UK data protection law.
• The standards cover seven areas: risk assessment, awareness, securing technology, user accounts, licensing and updates, backups and reporting.
• Cyber Essentials and ISO 27001 are not mandatory for schools. Senior leaders decide whether certification suits them.
• Responsibility is shared: a senior leadership team (SLT) digital lead owns the work, with IT support, the data protection officer and governors or trustees.

Table of Contents

• Which rules apply, and which are expectations
• The 2030 ambition and the six core standards
• What the DfE standards expect you to have in place
• Who owns it: the SLT digital lead and the board
• Data protection and incident reporting
• Cyber Essentials and ISO 27001: required?
• Insurance and protective services already in the sector
• A practical sequence for the next term
• Promo: evidence that matches the standards
• Our view: standards are a floor, detection is the gap
• FAQ
• Sources

Which rules apply, and which are expectations

It helps to separate what is law, what is statutory guidance and what is the DfE’s recommended way to comply. The table summarizes it.

The first row matters most. The GOV.UK core standard page states that schools and colleges have a statutory responsibility to keep children and young people safe online as well as offline, and that this includes appropriate cyber security measures. The same page explains that the DfE standards set out the recommended approach to meeting those expectations. In practice, if a serious incident ever leads to questions, the standards are the yardstick a governing body will be measured against.

Does this apply outside England?

The DfE standards are England-only guidance. The DfE’s 2025 consultation on narrowing the digital divide set a long-term ambition for all schools and colleges to meet six core digital and technology standards by 2030 and noted that its proposals apply to England only. Schools in Scotland, Wales and Northern Ireland should follow their own education departments’ guidance, although UK data protection law applies everywhere.

The 2030 ambition and the six core standards

The DfE’s 8 July 2026 blog post lists six core standards that all schools and colleges should aim to meet by 2030: filtering and monitoring, cyber security, broadband internet, wireless network, network switching, and digital leadership and governance. Cyber security sits alongside the others, which means your estate plan, your network plan and your security plan should be one conversation, not three.

The standards were refreshed on 20 May 2024. According to the GOV.UK updates page, the update set out tasks for both the SLT and IT support, stressed that cyber security is a shared responsibility, and changed the format so that staff without cyber expertise can follow it. In July 2026 the DfE also launched a Cyber Security Hub with practical guidance for schools in England on strengthening resilience, reducing risk and responding to incidents.

What the DfE standards expect you to have in place

The DfE Cyber Security Hub sets out the expectations. Here is each one, what it means in plain terms and where schools usually fall short.

1. An annual cyber risk assessment, reviewed each term

A risk assessment identifies weaknesses and the actions that reduce risk. The standards call for it annually and a review every term, which catches new systems, new suppliers and staff changes. The common failure is a one-off document written for an inspection and never revisited. The NCSC also recommends that cyber incidents are treated as a risk management issue, listed on the school’s risk register beside other IT and data risks and referenced in business continuity, data protection and acceptable use policies.

2. A cyber awareness plan for pupils and staff

Most incidents begin with a person, not a firewall: a phished password, a malicious attachment, a payment request that looks genuine. The standards expect a plan for both staff and students. The test is whether new starters, supply staff and governors are covered, not just the permanent teaching team. Our guide to security awareness training topics lists what such a programme should cover.

3. Securing technology and data

This means anti-malware and a firewall on the school’s technology. The DfE’s explanation is that once a virus or hacker is inside a system, they look for other weaknesses to exploit, so every network-connected device, including Internet of Things equipment such as smart boards, cameras and door controllers, must be securely configured, kept up to date and protected. Many schools have a good firewall and a forgotten estate of unmanaged devices behind it.

4. Controlling and securing user accounts

The standard covers access privileges: who can reach which systems and data, and how accounts are protected. The SLT digital lead is expected to work with the data protection officer to assess staff access and permissions, and to check that email is set up so third parties find it harder to send imitation emails in your name. Leavers whose accounts stay live and shared administrator logins are the usual findings.

5. Licensing and keeping technology up to date

Unlicensed or unsupported software does not receive security patches. The expectation is that technology is licensed and updated, which in turn needs an accurate inventory of what you own. Without an inventory, nobody can say whether a vulnerability affects you.

6. A data backup plan, reviewed annually

Backups decide whether a ransomware attack is a bad week or a lost term. The standards expect a backup plan reviewed every year. Review it with a restore in mind: can you actually recover your management information system and your safeguarding records, and how long would it take?

7. Reporting cyber attacks

Everyone is responsible for reporting an incident to IT support and the SLT digital lead. Formal reporting to outside bodies is done by someone the SLT digital lead appoints. The next section explains who needs to be told.

Who owns it: the SLT digital lead and the board

The 2024 standards document makes the SLT digital lead accountable for the cyber risk assessment standard. That person works with IT support, the data protection officer, facilities or estates management, the headteacher or principal, the business or finance team, and the governing body or board of trustees. Cyber security is not an IT ticket; it touches finance (payment fraud), estates (door and CCTV systems) and safeguarding (pupil records).

For governors and trustees, the NCSC advises that the board’s role is strategic: making sure IT policies and procedures cover the use of ICT systems and data security, including GDPR compliance, and making cyber security a regular agenda item at board meetings. A short termly report from the digital lead, with the risk assessment status and any incidents, satisfies this and gives the board something concrete to challenge.

Data protection and incident reporting

Alongside the standards, data protection law applies. The GOV.UK data protection in schools guidance explains that for most personal data, the school or multi-academy trust is the data controller under the Data Protection Act 2018. That makes it responsible for deciding what data to collect, why, how long to keep it and who can see it. A controller must register with the Information Commissioner’s Office (ICO), and governors and trustees must check that the school has good network security to protect personal data and a business continuity plan that includes cyber security.

If an incident happens, the DfE standards set out who to tell:

• Suspicious cyber incidents go to Action Fraud.
• Cyber attacks go to the DfE sector cyber team.
• The ICO is told where a data breach has or may have occurred.
• The NCSC should be informed if an incident causes long-term closure, closure of more than one school, or serious financial damage.
• Academy trusts report attacks to the ESFA, as the standards state.

The data protection officer should be involved from the start so that any data protection issue is identified quickly. Our guide on ransomware incident response covers how services keep running during recovery.

The DfE’s earlier 2022 standards also expected schools to complete a Data Protection Impact Assessment for personal data held and to include a contingency plan for loss of some or all IT systems in their business continuity and disaster recovery plan. The DfE’s point there still holds: a plan made ahead of time speeds up the response and reduces confusion and stress.

One more place data leaks: the school website. If you use a chat assistant to answer parents’ questions, apply website chatbot security controls so that pupil or family details are not exposed through it.

Cyber Essentials and ISO 27001: required?

Neither is mandatory. The DfE’s 2024 standards state that Cyber Essentials certification is not a requirement for schools, though some may wish to complete it, and that it is for senior leaders to decide whether it is right for their school now and in future. Cyber Essentials is a government-backed annual certification covering technical controls across all sectors, and is distinct from the DfE standards. Our guide to Cyber Essentials requirements explains the five controls and the Plus level.

ISO 27001 is not a legal requirement in the UK either. It becomes relevant when a contract demands it, typically public-sector work involving sensitive data or regulated industries. A trust running commercial arms or international partnerships may meet that situation. Our comparison of Cyber Essentials, ISO 27001 and SOC 2 helps you choose.

Insurance and protective services already in the sector

The DfE’s consultation noted that 56% of schools in England were taking part in the Risk Protection Arrangement (RPA), which has included cyber incident cover as standard since the 2022/23 membership year, with a 24/7 incident response service for members. The consultation also described the NCSC’s free Protective DNS service for schools, which helps block threats such as malware, ransomware and phishing, and the tools Jisc provides for colleges. These are useful foundations. They do not replace the school’s own evidence that it has assessed risk, trained people and tested recovery, which is what the standards ask for.

A practical sequence for the next term

1. Name the owner. Appoint the SLT digital lead and record who the data protection officer, IT support lead and governor link are.
2. Baseline your position. The DfE and South West Grid for Learning offer a free self-assessment tool through the Cyber Security Hub. Use the result as your starting point, then validate it with an independent review of the technical estate.
3. Write the risk assessment and put cyber risk on the risk register, with a termly review date.
4. Fix accounts first. Multi-factor authentication for staff accounts reaching cloud or remote systems, removal of leaver accounts, and a review of administrator rights.
5. Test the backups by restoring something real, and record how long it took.
6. Rehearse an incident. Walk the SLT, IT support and the data protection officer through who reports what to whom.
7. Schedule awareness sessions for staff, governors and pupils, and repeat them.

Steps 2, 4 and 5 are where schools most often discover that the paperwork and the real network disagree.

Promo: evidence that matches the standards

We deliver IT security audits, penetration testing, vulnerability management, managed SOC and SIEM, MDR, phishing simulation and user awareness training for organizations in regulated sectors, including education. Our IT security audit explains findings in clear terms and gives an actionable roadmap, so the SLT digital lead can take a prioritized plan to the board rather than a generic checklist.

If your risk assessment lists threats you cannot yet detect, our managed SOC services and vulnerability management services give you ongoing coverage that scales as your trust grows. To see how our global IT support fits a multi-site estate, start at Zero Through.

Our view: standards are a floor, detection is the gap

We read the DfE standards as a sensible floor. A risk assessment, awareness plan, backups and tidy accounts are what a school needs to have settled before anything else. The gap we see in the standards is the question they cannot answer for you: if someone is already inside your network tonight, would anyone know?

That is why we pair assessment with ongoing detection. An IT security audit and penetration testing show where the weaknesses are. Managed SOC and SIEM services, and MDR, watch for the activity that exploits them, and vulnerability management keeps the list of weaknesses shrinking. Our model is built to be scalable and customizable, so a single school and a multi-site trust can start where they are and grow without changing approach.

Our approach is to explain security findings in clear terms and give leaders an actionable roadmap. Governors and trustees do not need jargon; they need to know what the risk is, what it will take to reduce it and what has changed since last term.

Shirish

FAQ

Is the DfE cyber security standard legally binding?

The standards are the DfE’s recommended approach to meeting the statutory expectations in KCSIE, which requires appropriate cyber security measures. Schools and colleges should be working towards meeting the standards by 2030. Data protection law, including the duty to protect personal data, is legally binding in its own right.

Do schools need Cyber Essentials?

No. The DfE’s 2024 standards state that Cyber Essentials is not a requirement for schools. Senior leaders decide whether certification is right for their school now and in future, and some choose it to add assurance on technical controls.

Is ISO 27001 mandatory for schools?

No. ISO 27001 is not a legal requirement in the UK. It is mainly a prerequisite for certain contracts, such as public-sector work involving sensitive data, so it matters only if a contract you want asks for it.

Who should a school report a cyber attack to?

Staff report internally to IT support and the SLT digital lead first. The person they appoint then reports to Action Fraud, the DfE sector cyber team and, where personal data is involved, the ICO. Academy trusts also report to the ESFA, and the NCSC should be told of long-term closures or serious financial damage.

Sources

• Meet the Cyber Security Standards, DfE Cyber Security Hub
• Cyber security core standard, GOV.UK
• Updates to the digital and technology standards, GOV.UK
• DfE Cyber Security Standards, 20 May 2024
• DfE Cyber Security Standards, 2022
• Narrowing the digital divide in schools and colleges, DfE consultation
• Plan technology for your school, DfE blog, 8 July 2026
• Cyber security in schools: questions for governors, NCSC
• Data protection in schools: responsibilities, GOV.UK

Recommended

• Cyber Essentials Requirements: The Five Controls, Scope and Plus
• Security Awareness Training Topics Every UK Team Needs
• Remote Work Security: A Practical Guide for UK Businesses
• IT Security Audit Checklist for UK Businesses