The days when a school’s IT security measures simply meant turning computers off at the end of the day are long gone.
For many headteachers, the challenge has evolved from stopping pupils accessing inappropriate websites to defending their school against organised criminal gangs deploying ransomware, deepfakes and social engineering attacks.
The scale of the problem is stark. Almost three-quarters (73%) of secondary schools identified a cyber breach or attack in the past 12 month, according to the DfE’s Cyber Security Breaches Survey 2025/2026.
Fallout
The human and financial cost when things go wrong can be devastating. Active Learning Trust, a multi-academy trust in Cambridge and Suffolk supporting almost 9,000 students and 1,400 staff, suffered a ransomware attack in July 2024 that cost more than half a million pounds and consumed 1,200 hours of staff time.
Staff found they were locked out of systems from 6.30am on the morning of the attack, with ransomware files encrypted across 10 sites. The trust had to rebuild its entire server infrastructure from scratch.
Stories like this are becoming routine. Ransomware attacks are increasingly linked to deepfake and blackmail issues, and when a school’s systems are crippled, everything can be affected – entry to the building, lunch payments, classroom learning, daily administration, and contacting parents and staff.
This is why cyber security must be recognised as a leadership issue, not just an IT problem.
In a 2026 Ofqual survey, only 9% of teachers said senior leadership was responsible for cyber security. That disconnect is precisely what the updated DfE cyber security standards are designed to address.
What the law and guidance require
Schools and colleges have a statutory responsibility to keep children safe online as well as offline. Paragraph 178 of Keeping Children Safe in Education (KCSiE) 2026 requires governing bodies and proprietors to ensure their school has appropriate cyber security systems in place, indicating this should be approached as part of its wider safeguarding responsibilities.
Paragraph 179 draws attention to the DfE’s cyber security standards for schools and colleges, which outlines actions they should consider implementing to strengthen resilience, reduce the risk of disruption, prevent data breaches, and mitigate safeguarding risks.
The standards cover topics including annual risk assessments, multi-factor authentication, staff training, data backups, software licensing and incident reporting. Schools are expected to be working towards meeting them in full by 2030.
These have recently been updated and are more detailed than before. The expectation on school and trust leadership to have genuine awareness and oversight of cyber security has never been greater.
Responsibility for this should sit with a member of the SLT team, working alongside the designated safeguarding lead and IT support.
Ten steps every school should take now
1. Appoint a named SLT member responsible for cyber security
This person will be accountable for, and prioritise and co-ordinate activity relating to, the cyber risk assessment standard. Governing bodies and proprietors should also identify a named governor to be responsible for ensuring the cyber security and filtering and monitoring standards are met.
2. Ensure your governing body or trust board has genuine knowledge, not just awareness
KCSiE makes clear that governing bodies must understand their responsibilities here, and should check that digital technology is fully licensed as part of their normal compliance review. Governors and trustees may need training to ask the right questions and to discharge their responsibilities effectively.
3. Put cyber security on your audit and risk register with individual, not committee, accountability
Cyber risks should be captured in the risk register and placed into a regularly tested business continuity plan. We consistently see schools treating this as a committee responsibility – the risk register must name a person, not a committee, as ultimately responsible.
4. Conduct a cyber risk assessment annually and review it every term
Schools should complete cyber risk assessments as soon as possible and repeat them every year, or following significant technology or process changes or an incident. The SLT digital lead should revisit these every term working with IT support, the data protection officer (DPO), facilities management and the finance team.
5. Implement and test filtering and monitoring across all devices and all locations
Filtering is preventative; monitoring is reactive. Both are legally required, and both must cover all school-managed devices including those taken off-site, bring-your-own devices and guests on the school internet. Schools must also consider the safeguarding implications of AI-generated content when reviewing their systems.
6. Enable multi-factor authentication (MFA) for all staff accounts
MFA should be enabled for all staff accounts with access to cloud services or remote access to on-site systems, and for all IT administrative accounts. IT support must also manage a joiners, leavers and movers process with HR, and review accounts every term to suspend or delete those no longer in use.
7. Apply software security updates within 14 days of release
Vulnerability fixes for operating systems, applications and firmware must be completed within 14 days when the vendor rates them as critical or high risk, or when they carry a CVSS v3.1 base score of 7.0 or above for assessing cyber security vulnerabilities. Where the DfE issues specific instructions on security updates, these must be applied within five working days.
8. Have a tested, off-site data backup and test it every term
Schools should hold at least three backup copies of important data, on at least two separate devices, with at least one copy off-site; backups must be immutable to prevent ransomware corrupting them on restoration. The SLT should identify in advance, with the designated safeguarding lead, DPO and finance team, which data areas would need to be recovered first in the event of an incident.
9. Train all staff and governors at least annually
Cyber training must include students, staff, at least one current governor or trustee, and anyone else with a login such as supply teachers. Training should cover phishing, password security, social engineering, MFA and how to report an incident. If you have risk protection arrangement (RPA) insurance cover, you must evidence that relevant users have undertaken the free National Cyber Security Centre (NCSC) training annually.
10. Have a cyber response plan and know exactly how to report an attack
A cyber response plan must be in place – it is both part of your business continuity plan and a condition of RPA cover. Schools must report attacks to their RPA or cyber insurer, to Report Fraud and to the DfE sector cyber team, and to the Information Commissioner’s Office within 72 hours where a high-risk data breach has or may have occurred.
Final thoughts for school leaders
The question school leaders should be asking is not “Could we be hit?”. The statistics make clear the answer is almost certainly yes. Only 14% of primary schools and 23% of secondary schools have covered all 10 of the government’s recommended cyber security steps, according to the Cyber Security Breaches Survey 2025.
Cyber incidents can cause safeguarding failures, significant financial loss, lasting operational disruption and serious reputational damage. Those risks sit squarely with school and trust leaders to manage – and the updated DfE standards provide a clear framework for where to start.
Dai Durbridge is a partner at Browne Jacobson, specialising in education law, safeguarding and governance.
