Assess your cyber risks now, then every year and after any significant change, and review the assessment every term. Record your network, the data you process and who has access to what, how likely and how damaging an incident would be, and how you will respond. Keep business continuity documents in more than one place, and report the risks to governors or trustees as part of your risk management.

Evidence to keep: the risk assessment and its termly reviews, a network diagram, your data and access records, and governor or trustee minutes showing the risks were discussed.

Have an acceptable use policy that fits your school. Train staff, governors, temporary workers and students at least once a year on phishing, passwords, social engineering, malware, device security, USB risks, MFA and how to report an incident, pitched at the right age for students. If you rely on the Risk Protection Arrangement for cyber cover, evidence that staff complete the free NCSC training every year.

Evidence to keep: the policy, training completion records by staff group (including supply and temporary staff), and NCSC training certificates.

A properly configured boundary firewall with DDoS protection, firmware updated termly, default passwords changed, remote administration restricted and protected with MFA, and inbound unauthenticated connections blocked. Centrally managed anti-malware on every device, scanning of web pages, email attachments and downloads, blocking of malicious websites, USB storage blocked unless there is a genuine need, unnecessary software removed, and email set up to make it harder for others to impersonate you.

Evidence to keep: firewall configuration and update records, anti-malware console reports, and your email authentication settings.

Unique accounts for everyone; strong passwords (machine-generated or three random words); lockout after no more than 10 failed attempts; MFA on all staff cloud accounts and IT administrator accounts. Access only as the role needs; accounts disabled immediately when people leave, ideally through an automated joiner, mover and leaver process; accounts reviewed termly; administrator accounts separate from everyday ones; administrator changes approved by senior leaders or trustees; and a secure emergency administrator account.

Evidence to keep: MFA coverage reports, termly account reviews, leaver records and administrator approval records.

Everything licensed and still receiving security updates. Licence expiry dates in a contracts register and end-of-support dates in an asset register, both reviewed termly, with senior leaders told about unsupported technology. Critical and high-severity vulnerabilities (CVSS 7.0 or above) fixed within 14 days; DfE-issued security updates applied within 5 working days; devices that cannot be patched isolated from the network.

Evidence to keep: the asset and contracts registers, patch reports showing the 14-day timeline, and a list of any isolated devices.

At least three copies of important data, on at least two separate devices, at least one off-site (which can be cloud). Backups immutable, so they cannot be altered once made; tested termly and after significant changes, with the tests logged; able to restore to different hardware; physical off-site backups encrypted and never kept at an employee’s home. The backup plan forms part of your business continuity and disaster recovery plans and is reviewed every year.

Evidence to keep: the backup plan, restore test logs with how long recovery took, and confirmation that copies are immutable.

Everyone knows to report incidents to IT support and the senior leader for digital. You activate your cyber response plan, contain the incident, tell your DPO, safeguarding lead and governors, and record what happened. Externally, depending on the incident: your RPA or insurer; Report Fraud (formerly Action Fraud); the DfE sector cyber team; the NCSC where an incident causes long-term closure, affects several schools or causes serious financial damage; the ICO within 72 hours for a reportable personal data breach; and Jisc for further education.

Evidence to keep: the response plan with contacts held offline, and an incident log.

The DfE says schools and colleges should meet them, and several are expected now. Some are conditions of RPA cyber cover, and colleges have funding-agreement requirements. In practice, treat them as the minimum.

According to the DfE standards: NCSC-standard backups with at least one copy off-site, annual NCSC staff training with evidence, and a cyber response plan. Check the current RPA membership rules for full conditions.

Critical and high-severity vulnerabilities (CVSS 7.0 or above) within 14 days, and DfE-issued security updates within 5 working days.

Your RPA or insurer, Report Fraud, the DfE sector cyber team, the NCSC for serious incidents, the ICO within 72 hours for a reportable personal data breach, and Jisc for further education.

The standard requires MFA for all staff cloud accounts, which includes teachers, and for all IT administrator accounts.