For school leaders, business managers and governors · Checked 5 November 2026
The DfE cyber security standards, in plain English
You've probably heard “by 2030” and put this on next year's list. Here's what the standards really ask of you, which parts should already be done, and how to find out where you stand.
The short version
2030 is the finish line, but much of this is due already
The DfE's Cyber Security Hub says schools should be working towards these standards by 2030. Read the standards themselves and most sections say something sharper: you should already be meeting this. On backups, the wording is “you must backup your data now”.
So the useful question isn't whether you'll be ready by 2030. It's which of these seven you could prove today if a governor, an insurer or a parent asked.
The checklist
What each standard asks for
Conduct a cyber risk assessment
Assess your cyber risks every year, revisit them every term, and again after any incident or big change. Put a cyber response plan in place: it is also a condition of RPA cover.
As soon as possible, then yearly and termly
Create a cyber awareness plan
Train staff and students at least once a year, along with at least one governor or trustee, and have an acceptable use policy everyone has seen.
Policy should already be in place
Secure technology with anti-malware and a firewall
Keep anti-malware running, set up and monitor your firewall, change default administrator passwords, and protect the firewall's admin access with MFA where available.
Should already be in place
Control and secure user accounts
Agree who gets access to what. MFA must be on for all IT admin accounts, and for staff accounts with access to cloud services or remote access to on-site systems.
Should already be met
License technology and keep it up to date
Keep everything licensed and supported. Critical and high-risk fixes, and anything with no vendor rating, must go on within 14 days of release.
Should already be met
Develop a backup plan
Keep at least 3 copies of important data on at least 2 separate devices, with at least one off-site. Make backups immutable, and test restores. Review the plan every year.
“You must backup your data now”
Report cyber attacks
Make sure everyone knows how to report a problem. Report incidents to your RPA or insurer, Report Fraud and the DfE sector cyber team, and tell the ICO as soon as possible, within 72 hours, where a personal data breach is likely to put people at risk.
Should already be met
Risk Protection Arrangement
The RPA cyber cover conditions
Offline backups
A copy an attacker on your network can't reach, within the DfE's backup level of 3 copies on 2 devices with 1 off-site. Check your RPA terms for the exact wording.
NCSC cyber security training
The National Cyber Security Centre's free training, taken every year by the relevant users, with evidence that they did.
Police CyberAlarm
Your school registered with the free Police CyberAlarm tool.
A cyber response plan
Written down, tailored to your school, and somewhere you can still reach it during an attack.
Cyber response plan
A template is only the start
The DfE gives you a free template and a checklist, and they're good. But a plan only works if it has your people in it. It needs deputies for every role, up-to-date phone numbers, messages already drafted for staff and parents, and a copy you can reach when your systems are gone.
It also needs to have been tried. The first time your leadership team works through an attack shouldn't be during one, which is why we run a live exercise as part of our Cyber Response Plan & Exercise.
Governors and trustees
Six questions for your next meeting
- 1 When did we last assess our cyber risks, and when did we last revisit that assessment?
- 2 When did we last restore something from backup, and how long did it take?
- 3 Does every member of staff with access to cloud systems use multi-factor authentication? And every IT admin?
- 4 Which suppliers hold our pupils' data, and who would they contact if they were attacked?
- 5 If every system were down tomorrow, is our plan on paper, and has anyone practised it?
- 6 If we're in the RPA, can we show we meet its cyber cover conditions today?
Common questions
DfE standards and school audits
Are the DfE cyber security standards mandatory?
The DfE says schools and colleges should be working towards meeting its digital and technology standards by 2030, but don't read that as years of breathing space on everything. Several cyber standards say you should already be meeting them, and the backup standard says you must back up your data now. Schools also have a statutory duty under Keeping Children Safe in Education to keep children safe online, and the DfE says that includes appropriate cyber security.
What's the difference between the DfE standards and Cyber Essentials?
The DfE standards are written for schools and colleges and cover cyber governance, processes and strategy. Cyber Essentials is a government-backed annual certificate for any kind of organisation, focused on the technical side. It's a funding requirement for colleges, and something some schools choose to do. The DfE says the standards can help you work towards it.
What are the RPA cyber cover conditions?
The DfE lists offline backups, NCSC cyber security training, registration with Police CyberAlarm and a cyber response plan among the conditions. The RPA is for public sector schools. Check your scheme terms for the exact current wording, since that's what would apply to a claim.
Do we need a cyber security audit?
The DfE doesn't require you to buy one. It asks you to assess your risks every year and revisit them every term, and says to get outside advice if you don't have the expertise in-house. Its plan technology for your school service helps you self-assess. An outside review earns its cost when nobody on your team has time to do this properly, or when your governors want an independent view.
How does this apply to our IT provider?
The DfE says to ask outsourced IT support how they're meeting each standard, and how they'd stop an attack on their own network reaching yours. It suggests asking whether they hold Cyber Essentials or Cyber Essentials Plus. For the risk assessment standard, it says any gap should be sorted through your service reviews, and no later than your next renewal date.
Do these standards apply outside England?
The DfE's Cyber Security Hub is written for schools in England. Elsewhere in the UK your own education department and local arrangements come first, though the standards still make a useful yardstick.
Want to know where you stand, without losing a week to it?
Give us a couple of hours with you and your IT provider. We'll go through all seven standards and the RPA conditions with you, and send you a report your governors can read, with the fixes in priority order. Prices start at £950 for a primary school, fixed in writing before we begin.