188体育

Why this standard is important听

Those in schools and colleges need to know the risks associated with their hardware, software and data to properly mitigate and defend against any potential cyber incidents or attacks. 听

听Assessing cyber risks means you can:听

• understand how to keep students, staff and the wider school or college community safe 听
• understand how prepared the school or college is in response to a cyber incident or attack听
• highlight weaknesses and put processes in place to help reduce risk听
• secure systems to make sure they are more resilient to cyber incidents and attacks听
• prepare a cyber response plan to be implemented quickly in the event of a serious incident to minimise any impact to the school or college听

Not identifying and assessing risk, or preparing a response, could lead to:听

• safeguarding issues if students鈥� safeguarding information is unavailable or if confidential data is accessed and misused听听
• lasting disruption to the operation of the school or college, including closure听
• significant impact on student outcomes听
• other schools or colleges on your broader organisational network 鈥� such as those within a multi-academy trust 鈥� being impacted by the same cyber incident or attack听
• a significant data breach听
• reputational damage听
• significant unexpected spend and lost staff time to recover systems and data听

Who needs to be involved听

The senior leadership team (SLT) digital lead will be accountable for, and prioritise and coordinate activity relating to this standard. IT support (who may be an internal support person or external provider) will action this standard.听听

You can find out more about the role of the SLT digital lead in our standards on digital leadership and governance.听

The SLT digital lead will work with:听

• IT support to review the outcomes of discussions with key staff and action them within the risk assessment听听
• any IT leads in your broader organisation (if applicable) to find out if anything needs to be actioned or approved by them听
• the data protection officer (DPO) who will give advice on any risk around data and processes to make sure personal and sensitive personal data in schools and colleges is secure
• facilities or estate management to identify any physical security risks that could create problems for core systems and data, such as a door that will not lock on a server room听
• the headteacher or principal who will need to make decisions on actions suggested by the SLT digital lead and IT 蝉耻辫辫辞谤迟听
• the school, college or trust business professionals or the finance team who will help budget and plan for any changes needed, update the risk register, and buy in any additional services needed听
• the governing body or board of trustees for oversight and strategic risk management 鈥� there are some 听

If you do not have the technical expertise in-house, you will need to get advice from an external support provider or consider training for your internal IT staff to make sure they have the skills needed.听

If your IT support is outsourced, then you will need to discuss with them how they are meeting the requirements of this standard. This should include how they will mitigate against any cyber incidents or attacks on their own network impacting on your school or college鈥檚 network. As part of this, you may wish to consider asking them whether they are certified with Cyber Essentials or Cyber Essentials Plus.听

How to meet this standard听

This standard should be a part of your overall digital technology strategy.听

Read the digital leadership and governance standards for more information on how to create a digital technology strategy.听

Review assets听

The SLT digital lead and your IT support will:听

• review digital technology assets and any related cyber security risk听
• check all digital technology is licensed, supported and updated 鈥� read our standard on license digital technology and keep it up to date听

Check data processing, access and permissions听

The SLT digital lead will work with the DPO to:听

• complete a record of processing activities (ROPA) for all new and current systems storing or processing personal and sensitive personal data 鈥� you can use a 听
• assess staff access and permissions to systems and data, and check password policies 鈥� read our standard on 鈥楥ontrol and secure user accounts and access privileges鈥�
• check that your email is set up to be secure and that it reduces the risk of third parties being able to send imitation emails 鈥� for more information, read our standard within this topic titled, 鈥楽ecure digital technology and data with anti-malware and a firewall鈥�

Understand your network听

The SLT digital lead will oversee this work, but IT support will:听

• keep documentation on your network up to date 鈥� this should include network diagrams, changes that are made, settings and IP addressing information听
• discuss the level of logging required for your school or college鈥檚 network and systems which can help to identify the source of any cyber incident or attack and any network issues 鈥� to learn more about network logging, visit the National Cyber Security Centre (NCSC) 听

Understand current risk听

The SLT digital lead will be responsible for collecting the relevant information from all those listed in the 鈥榃ho needs to be involved鈥� section of this standard. Together they will:听

• understand what the greatest cyber risks are and establish the likelihood of these happening, along with the impact they may have on your school or college听
• capture how many cyber incidents or attacks have already occurred and what they are so that you can understand common themes and know where you need to improve 鈥� you can 听
• identify any student or staff behaviour that may be seen as a risk and could expose the school or college to a cyber incident or attack 鈥� for example, downloading an application without the approval of IT 蝉耻辫辫辞谤迟听

Create a risk management process and cyber response plan听

The SLT digital lead will work with the business professionals or the finance team, estate management and IT support to:听

• create a simple reporting structure for cyber risks to be captured, escalated and actioned 鈥� cyber risks should be captured in the risk register and placed into a regularly tested business continuity plan听
• maintain documentation and your business continuity plan in at least one or more (diverse) locations 鈥� for example, in the cloud or as a hard copy听
• flag any risks or issues identified to the governors or trustees as part of the school or college鈥檚 risk management process听
• put a cyber response plan in place 鈥� as well as this being a part of your business continuity plan, it is also a condition of cover if you have risk protection arrangement (RPA) cover听

We recommend getting insurance cover to help minimise costs in the event of a cyber incident or attack. You could consider the Department for Education鈥檚 (DfE) RPA cover as an alternative to commercial insurance.听

To help action this standard, you can also visit:听

• our digital leadership and governance standards for information on a business continuity plan听
• the DfE website for guidance on risk management for academy trusts听
• to self-assess your cyber resilience and understand where you are in your cyber maturity journey听
• the Education Data Hub for 听

When to meet this standard听

You should complete any risk assessments as soon as possible and repeat them every year or in the event of:听

• significant technology or process changes听
• an incident or attack impacting the school or college听

These risk assessments should then be revisited every term by those listed in the 鈥榳ho needs to be involved鈥� section of this standard to see if anything has significantly changed. This will help highlight vulnerabilities and what actions you need to take to minimise them.听

If you have outsourced IT support and they are not currently meeting this standard, then you will need to review how this can be done in future as part of your ongoing service reviews, and no later than your next renewal date.听听

Related standards听

The following digital standards should also be considered when completing this standard.听听听

Digital leadership and governance:听

• Assign a senior leadership team (SLT) member to be responsible for digital technology
• Keep registers relating to hardware and systems up to date听
• Include digital technology within disaster recovery and business continuity plans听

Cloud solution:听

• Cloud solutions must follow data protection legislation听

Servers and storage:听

• Servers and related storage platforms must be secure and follow data protection legislation听

Why this standard is important听

Well-informed users are the best line of defence against cyber criminals. Many cyber incidents and attacks target common processes and human behaviours when using digital technology.听听

Raising awareness, and training students and staff on cyber security will:听

• reduce the risk of cyber incidents and attacks听
• help to keep students and staff safe听
• help to create a culture where students and staff feel comfortable identifying and reporting risk听
• help students and staff understand what acceptable use of digital technology looks like and the importance of cyber security 鈥� this can help inform behaviour policies听
• make sure that cyber incidents, attacks and risks are reported quickly to stop them spreading听

If students and staff do not understand the risks, this could lead to:听

• safeguarding issues, particularly when data is breached听听
• cyber incidents and attacks that are costly and disruptive听

Having an acceptable use policy and training in place will help to provide the foundations for a good cyber awareness plan.听

Who needs to be involved听

The headteacher or principal will be accountable for making sure this standard is met. They will work with the senior leadership team (SLT) digital lead, who will coordinate the delivery of an acceptable use policy and training for their school or college.听

The SLT digital lead will need to work with:听

• IT support to create and maintain the acceptable use policy and identify areas of training need from support calls听
• any IT leads in your broader organisation (if applicable), such as a multi-academy trust or a local authority school to find out if anything needs to be actioned or approved by them听
• the data protection officer (DPO), who will make sure that risks to data are identified and acted on, and will advise on any data protection training needed听
• the designated safeguarding lead, who will make sure that any training and policies support the safety of students and staff听
• the governing body or board of trustees to approve the acceptable use policy 听

If you do not have the technical expertise in-house, you will need to get advice from an external support provider or consider training for your internal IT staff to make sure they have the skills needed.听

How to meet this standard听

The SLT digital lead will work with IT support to make sure:听

• an acceptable use policy is created and updated to meet their school or college鈥檚 needs听
• regular and up to date training and awareness activities on cyber security are carried out听听

You should also consider how to raise the level of cyber awareness within families if digital technology is taken home or student work is completed online at home.听

Create an acceptable use policy听

An acceptable use policy describes what a person on the network can or cannot do when using digital technology.听听

Anyone who has access to the school or college network or data will need to be made aware of, and sign up to, the acceptable use policy. This will include guests and supply teachers who want to use the school or college network and wifi.听

The SLT digital lead will work with IT support, the designated safeguarding lead and the DPO to create and update the acceptable use policy.听

If you use a student contract, then this should include relevant sections of the acceptable use policy to make it clear how digital technology should be used within your educational setting. This will need to be carried out at the beginning of every academic year.听

You can find examples of acceptable use policies on the Education Data Hub website:听

• 听
• 听
• 听

Train students and staff听

Training students and staff in cyber security is a vital step in maintaining safety and security. Cyber training should be given at least annually, or more regularly if there is a known cyber risk to those who use school or college digital technology.听

The SLT digital lead will need to coordinate training with IT support, the DPO and the designated safeguarding lead. This training is for:听

• students听
• staff听
• at least one current governor or trustee听
• anyone else with a login (for example supply teachers or agency workers) who may need more focussed training using your own resources 鈥� this should happen as soon as it鈥檚 feasible听听

Training should be age-appropriate and suited to your school or college鈥檚 risks, but should generally include training on:听

• methods hackers use for tricking people into disclosing personal information, including 听
• password security听
• online safety听
• social engineering, including not using websites that host unsuitable material, and could also contain malware and viruses听
• the physical security of devices, for example not leaving a laptop unlocked and unattended听
• the risks of using removable storage media, such as USBs听
• multi-factor authentication听
• how to report a cyber incident or attack 鈥� read the standard on reporting a cyber risk within this standard topic
• how to report a personal data breach听
• data protection for all staff, with staff who are exposed to higher risk data having more frequent training, such as administrative staff, management or agency workers with a login听

If you have risk protection arrangement, you must evidence that the relevant users have undertaken the free training. This needs to be taken annually. 听

If you are looking for further support, the NCSC have .听

When to meet this standard听

You should already have an acceptable use policy in place. If not, it should be updated towards the end of the academic year and shared with students, staff, and any cover or temporary staff at the beginning of the new academic year.听

If you have not carried out cyber training in your school or college within the last 12 months, then you should plan to implement this as soon as possible.听

Related standards听

The following digital standards should also be considered when completing this standard.听听听

Digital leadership and governance:听

• Assign a senior leadership team (SLT) member to be responsible for digital technology

Laptops, desktops and tablets:听

• Devices should be safe and secure听

Creating and maintaining the security around your digital technology and data is a critical line of defence against a cyber incident or attack. Once a virus or hacker is in your system, they will look for a way to exploit other vulnerabilities.听

To complete this standard, the senior leadership team (SLT) digital lead and IT support will first need to read and action the standard on how devices should be safe and secure.

Why this standard is important听

Following this standard will help to make sure that:听

• students, staff and their data are as safe and secure as they can be听听
• the risk of disruption to school or college operations is reduced听
• there is no unauthorised access to systems or data听
• vulnerabilities are more difficult to find听

Not meeting this standard could lead to:听

• lost learning or possible school or college closure听
• not being able to access child protection data听
• students and staff being exposed to inappropriate content听
• a large financial cost听
• a significant data breach听
• the spread of viruses or malware throughout your network听
• security weaknesses, which make cyber incidents or attacks easier against your network听

Who needs to be involved听

The SLT digital lead will be accountable for this standard but IT support will be responsible for actioning it.听

IT support will need to work with:听

• the designated safeguarding lead for advice on safeguarding requirements on systems and security听
• any IT leads in your broader organisation (if applicable), such as a multi-academy trust or a local authority school to find out if anything needs to be actioned or approved by them听

If you do not have the technical expertise in-house, you will need to get advice from an external support provider or consider training for your internal IT staff to make sure they have the skills needed.听

How to meet this standard听

The SLT digital lead will need to plan how the technical requirements section within this standard will be met with IT support.听

IT support will need to:听

• use a properly configured boundary firewall听听
• make sure devices are safe and secure 鈥� to learn more about this, visit the laptop, desktop and tablet standards听
• (this must include anti-virus) on all devices, this should be centrally managed, actively monitored and kept up to date 鈥� this should include installation on cloud-based servers that you are managing
• monitor digital technology for any potential cyber security incidents or attacks 鈥� the National Cyber Security Centre (NCSC) has a 听
• check the security of all applications downloaded or installed onto a network, this should include any cloud-based services听
• configure the network to minimise the spread of malware to critical systems听

If you are unsure about any data or applications, contact your IT support and they will be able to check the security of them.听听听

Technical requirements听

This section is for your IT support who may be an internal support team or an external provider. They will set up your network and digital technology to meet these minimum requirements.听

Firewall听

Many schools and colleges will be provided with a firewall as part of their broadband connection. If this applies to you, then you will need to discuss these technical requirements with your broadband provider.听

If your broadband provider does not include a firewall, then IT support will need to source one and set it up securely.听

To meet this standard, IT support must:听

• protect digital technology with a correctly configured boundary firewall or software firewall, this should include 听
• keep boundary firewall firmware up to date, and on supported versions 鈥� this should be checked termly听
• make sure all external connections to the network run through the firewall听
• change the default administrator password and restrict remote access on the firewall to only those who need to access it for maintenance purposes 听
• protect access to the firewall鈥檚 administrative interface with multi-factor authentication, where available, and prevent access from the internet, except to those who need to maintain the firewall听
• actively monitor firewall traffic and switch on firewall alerts to help detect suspicious activity 鈥� firewall logs can help you with both of these tasks听
• block inbound unauthenticated connections by default听
• document and review why inbound traffic has been permitted through the firewall 鈥� this should be done on a termly basis at a minimum and should be signed off by the SLT digital lead听
• keep firewall rules to an absolute minimum, with each rule being documented and subject to a risk assessment听
• enable a software firewall for digital technology that is used outside of the school or college, such as at home or on public wifi听
• consider a virtual private network (VPN) to encrypt data sent and received by a device听

Anti-malware software听

Anti-malware software needs to be kept up to date with the latest updates. This should be reviewed termly to check that it is meeting your school or college鈥檚 needs. This software must:听

• scan web pages as they are being used听听
• have a centralised monitoring console to allow IT support to intervene should anti-malware software fail or not update听
• scan files and applications upon access, when downloaded or opened locally or from a network folder听
• scan attachments on incoming and outgoing emails for malware听
• send malware alerts to IT support who will then investigate the issue 鈥� this could result in removing the malware or isolating the device听
• prevent access to potentially malicious websites听

The NCSC provide further guidance on .听

To help prevent malware infecting digital technology from an external device, IT support should prohibit the use of USB storage devices by default, unless for a specific need 鈥� for example, if the examination board require this.听

If USB storage devices are permitted in specific use cases, the anti-malware software should scan the USB drive before it is made available to the student or staff member.听

Security checks听

IT support should:听

• check downloads for malware before an individual can store or install them on their device 鈥� this should be in line with your school or college strategy
• check and approve all current and future applications to make sure they do not pose a security risk听
• maintain a current list of approved applications on your contracts register听
• remove unnecessary software according to your organisational need听
• only install applications that can be verified as coming from a known supplier听
• document how digital technology is set up, which security features have been enabled or disabled, and whether they have conflicting security features听
• to make sure the highest form of protection is enabled and that users are unable to change browser settings to install browser extensions or bypass security features听
• and that it reduces the risk of third parties being able to send imitation emails听

The NCSC has 听

When to meet the standard听

This standard should already be in place for the security of your network.听听

Completing the standard in this topic titled 鈥楥onduct a cyber risk assessment annually and revisit every term to review if anything has changed鈥� will help to inform this process.听

Related standards听

The following digital standards should also be considered when completing this standard.听听听

Servers and storage:听

• Servers and related storage platforms must be secure and follow data protection legislation听
• All server and related storage platforms should be kept and used in an appropriate physical environment听

Cloud solution:听

• Cloud solutions must follow data protection legislation听

Wireless network:听

• Install security features to stop unauthorised access听

Network switching:听

• The network switches should have security features to protect users and data from unauthorised access听

Digital leadership and governance:听

• Keep registers relating to hardware and systems up to date听
• Include digital technology within disaster recovery and business continuity plans听

Laptops, desktops and tablets:听

• Devices should be safe and secure听

Broadband:听

• Schools and colleges should have appropriate IT security and safeguarding systems in place, under both child and data protection legislation听

Why this standard is important听

Protecting user accounts and related data is a critical line of defence against cyber incidents and attacks.听

Following this standard will make sure that:听

• personal data and digital technology are as safe and secure as they can be听
• students, staff and third parties only have access to the things they need听

Not meeting this standard could lead to:听

• schools and colleges being exposed to external and internal threats
• a significant data breach听
• students and staff being exposed to inappropriate content听
• a disruptive and costly ransomware attack, which is a type of malware which prevents access to your data or device unless a ransom payment is made听
• not being covered by your insurer for cyber attacks and incidents听

Who needs to be involved听

The senior leadership team (SLT) digital lead will be accountable for this standard but IT support will be responsible for actioning it.听

IT support will work with:听

• any digital technology suppliers to make sure they are also compliant with this standard听
• the data protection officer (DPO) who will, if needed, undertake a data protection impact assessment (DPIA) and provide advice on data protection legislation compliance听
• human resources and your business professionals or the finance team to set up a process for movers, joiners and leavers听
• any IT leads in your broader organisation (if applicable), such as a multi-academy trust or a local authority school to find out if anything needs to be actioned or approved by them听

If you do not have the technical expertise in-house, you will need to get advice from an external support provider or consider training for your internal IT staff to make sure they have the skills needed.听

How to meet this standard听

The SLT digital lead will need to plan how the technical requirements section within this standard will be met with IT support and how they will:听

• agree who should have access to what听听
• set up password policies听
• , such as multi-factor authentication (MFA), where needed听

IT support should make sure that users only have the network and data access they need, and that their account is secure.听

To help action this standard, you can also visit:听

• the National Cyber Security Centre (NCSC) website for more guidance on 听
• the Information Commissioners Office (ICO) website to 听

Technical requirements听

This section is for your IT support who may be an internal support team or an external provider. They will set up users so that they only have the access they need by following these minimum requirements.听

If you have external IT support that will carry out the activities within this standard, make sure that your contract with them is compliant with General Data Protection Regulation (GDPR).听

Passwords听

Users must be authenticated with unique credentials before they access devices or services. This can include using passwords.听

IT support will need to:听

• enforce password strength at the system level 鈥� the 听
• immediately change any passwords that have been compromised or are suspected of compromise听
• protect all passwords 鈥� for example, by allowing no more than 10 guesses in 5 minutes, or locking devices after no more than 10 unsuccessful attempts听

On networking devices and servers, IT support should:听

• use a password or PIN of at least 6 characters to physically access network switches and boot-up settings 鈥� the password or PIN must only be used to access this device听
• agree a process with the SLT on securing access to key system passwords and PINs in the event of an emergency, or if IT support are unavailable听

For younger children, users with special educational needs or disabilities, or for those with English as an additional language, consider using:听

• other means of logging on, other than passwords 鈥� for example, using a PIN code听
• a separate account accessed by the teacher using the student鈥檚 login so that the student can still be identified 鈥� this should follow the filtering and monitoring standards听

Visit the NCSC website to .听

Multi-factor authentication (MFA)听

MFA secures your account by asking the user to provide 2 or more pieces of evidence to verify their identity. This could include a password and a login through another device.听

MFA may not be accessible for those with special educational needs and disabilities. In these circumstances you will need to discuss alternatives or extra support when logging in.听

Senior leaders, and staff (including internal and external IT support staff) working with confidential, financial, and personal and sensitive personal data must use MFA.听

If appropriate for your school or college, you may also wish to explore:听

• MFA for all cloud or online services听听
• MFA for all staff accounts听
• MFA for students where the verification does not need to be completed on a mobile phone in keeping with the Department for Education鈥檚 (DfE) 听

MFA should include at least 2 of the following:听

• a password听
• a text message which will send a code to a mobile device, this is for staff only听
• an automated phone call to a given phone number that reads out a code (as an alternative to a text message)听
• a secure portable device, such as a mobile phone or tablet for staff听
• a security key or device, used to authenticate logins 鈥� the school or college may need to pay for this if staff do not have access to a secure mobile phone听
• a known or trusted account, where a second party authenticates another鈥檚 credentials听
• a biometric test, for example face identification 鈥� this may need careful consideration as it might require a biometric policy depending on how the data is stored听

Where MFA is not available, a more complex password should be used following the recommended guidance around password security in this standard.听

The NCSC has some further guidance on:听

• 听
• 听

If staff access a number of systems, you should consider using a single sign on solution, which allows you to sign on once and access all applications.听

Account management听

IT support need to control user accounts and access privileges by:听

• disabling accounts as soon as someone leaves听
• creating and managing a process with human resources and your business professionals or the finance team to deal with joiners, leavers, and those moving roles听

IT support should consider using tools that link to the management information system (MIS) to automatically create or delete user accounts which will make this process easier to manage.听

IT support will also:听

• make sure that accounts are set up so that students and staff only have access to the data and systems they need听
• make sure that MFA is applied to any accounts and cloud-based applications for staff working away from the school or college, or remotely accessing the network 听
• make sure that remote access is disabled when not required, and enabled only by a member of authorised school or college staff听
• make sure that enhanced security, such as MFA, is always used where staff are handling confidential, personal or sensitive personal data 鈥� your data protection officer can advise which systems and data need this听
• review accounts with your business professionals or the finance team every term to identify changes that might have been missed 鈥� this should include changing access levels and rights, and suspending or deleting accounts which are no longer in use听
• make sure that global or administrative accounts are not used for routine business and that instead, dedicated accounts (not used for day-to-day email and work) have enhanced privileges 鈥� this helps limit any damage and track issues in the event of an incident or attack听
• agree a process for handling administrative accounts so that a member of SLT or a trustee approves any changes to access levels or privileges before IT support can action the change听
• make sure SLT have access to a dedicated administrative account 鈥� this will only be needed in an emergency where IT support is unavailable听

The NCSC has detailed .听

When to meet this standard听

You should already be meeting this standard. This will make sure that your data and digital technology is best protected against cyber threats.听听

If you are not already meeting this standard, then you should implement this as soon as possible through a structured, well managed rollout plan.听

Related standards听

The following digital standards should also be considered when completing this standard.听听听

Cloud solutions:听

• Cloud solutions should use ID and access management tools听
• Cloud solutions must follow data protection legislation听

Servers and storage:听

• Servers and related storage platforms must be secure and follow data protection legislation听

Laptops, desktops and tablets:听

• Devices should be safe and secure听

Network switching:听

• The network switches should have security features to protect users and data from unauthorised access听

Wireless network:听

• Install security features to stop unauthorised access听

Broadband:听

• Schools and colleges should have appropriate IT security and safeguarding systems in place, under both child and data protection legislation听

Why this standard is important听

All digital technology must be licensed. Digital technology includes software programmes, operating systems and applications running on devices and servers, or online cloud services.听听

These must be licensed so that you can:听

• receive updates and upgrades which enhance your use of digital technology听
• receive bug-fixes and enhancements听
• get support if you need it where this is provided through your license agreement听

Not licensing or updating digital technology could lead to:听听

• devices being vulnerable to viruses, malware and hackers 鈥� some unlicensed and unauthorised software may contain malware, especially if downloaded from untrusted sources听
• reputational damage for your school or college听听
• sudden unexpected costs from having to replace digital technology听听
• operating systems that have reached end-of-life or are not providing critical security updates听
• software or applications not being able to run, which could lead to disrupting teaching and learning听
• a breach of your licensing agreement, which could lead to fines or action from the supplier听

Who needs to be involved听

The senior leadership team (SLT) digital lead will be accountable for this standard, with IT support responsible for actioning it. 听

The governing body or board of trustees should check that the digital technology is fully licensed as part of their normal compliance review.听

Your internal or external IT support will work with:听

• business professionals or the finance team who will give information on when licenses are due to expire from the contracts register听
• the data protection officer (DPO) who will provide advice on data protection legislation and undertake a data protection impact assessment (DPIA), where relevant 鈥� if there is a licensing issue that could threaten the data, the DPO will need to escalate this to the SLT digital lead and IT 蝉耻辫辫辞谤迟听
• third-party cloud suppliers to check that they are also meeting these standards by performing supplier assessments 鈥� this needs to be carried out when procuring new contracts听
• any IT leads in your broader organisation (if applicable), such as a multi-academy trust or a local authority school to find out if anything needs to be actioned or approved by them听

If you do not have the technical expertise in-house, you will need to get advice from an external support provider or consider training for your internal IT staff to make sure they have the skills needed.听

How to meet this standard听

The SLT digital lead will plan how the technical requirements section within this standard will be met with IT support.听

IT support will need to check all digital technology is licensed, supported and set up to meet the technical requirements in the next section. The end of support dates for each device鈥檚 operating system should be recorded in the asset register and your mobile device management system, if you have one.听

At the end of every term, IT support and the business professionals or the finance team should review the contracts register and inform the SLT when digital technology:听

• has become unsupported听听
• is due to become unsupported听

You can find out more about the contract and asset registers by visiting our standards on digital leadership and governance.听

An alternative to licensing software is to use a cloud service. These are usually subscription based, and the responsibility is on the supplier to license and update the software. You should ask your DPO to undertake a DPIA if you choose to do this where it is storing or processing personal or sensitive personal data. Visit the Department for Education (DfE) website for more information on data protection policies and procedures.听

If you are using open-source software or operating systems, you must abide by their licensing terms.听

Occasionally, DfE may issue instructions on security updates. The SLT digital lead will need to inform IT support. IT support should then apply these updates within 5 working days of notification.听

Technical requirements听

This section is for your IT support who may be an internal support team or an external provider. They will set up your digital technology to meet these requirements.听

Licensing听

All software needs to be licensed and eligible for security updates. You should remove unlicensed software or take steps to license it.听听

IT support will need to check that:听

• operating systems and firmware on digital technology are kept up to date听
• updates are issued in a timely manner that does not impact on teaching and learning听
• license expiry dates are recorded in the contracts register by the business professionals or the finance team, and that any unlicensed software is removed from devices听
• your business professionals or the finance team have been informed about licence end dates so that they can budget for any renewal costs听
• digital technology end-of-support dates are captured in the asset register听

Security updates听

IT support must complete security updates (known as patching) to operating systems, applications and firmware, including configuration changes, within 14 days of the release of the patch where the vulnerability is:听

• described as high risk or worse听
• has a Common Vulnerability Scoring System (CVSSv3) score of 7 or above 鈥� you should also triage and prioritise updates for other scores when it is possible to do so听

The CVSSv3 is the security industry standard for measuring the danger of a vulnerability. The score is a number from 1 to 10 where 10 means it is the most easily exploitable. There is a more .听

IT support will also need to:听

• make sure security updates are applied on time 鈥� you may wish to consider using a supported third-party patch management tool to automate this process听
• isolate devices where high risk patches are unavailable 鈥� this could mean removing the device from the network or separating it from higher risk systems and data听

The NCSC has further .听

When to meet this standard听

You should already be meeting this standard with existing digital technology within the school or college. When buying new digital technology (including cloud-based services), you will need to check that it meets this standard.听

Related standards听

The following digital standards should also be considered when completing this standard.听听听

Digital leadership and governance:听

• Keep registers relating to hardware and systems up to date听
• Include digital technology within disaster recovery and business continuity plans听

Laptops, desktops and tablets:听

• Devices should meet or exceed the minimum requirements听

Cloud solution:听

• Cloud solutions must follow data protection legislation听
• Use cloud solutions as an alternative to locally hosted systems, including servers听

Servers and storage:听

• Servers and related storage platforms must be secure and follow data protection legislation听

Broadband:听

• Schools and colleges should have appropriate IT security and safeguarding systems in place, under both child and data protection legislation听

Network switching:听

• The network switches should have security features to protect users and data from unauthorised access听

Wireless network:听听

• Install security features to stop unauthorised access听

A backup is an additional copy of data, held in a different physical location (which could include being on the cloud), in case the original data is lost or damaged. If all copies were held in the same physical location, they would all be at risk from natural disasters, criminal damage or a malware attack.听

The physical location for your backup will need careful consideration to make sure that, in the event of a disaster situation, it is not impacted by the same incident or attack.听

which could include a cloud backup service. Members of the risk protection arrangement (RPA) should refer to their terms for making a claim, as backing up to this level is currently a condition of cover.听

The Education Data Hub has .听

Why this standard is important听

Schools and colleges are now more reliant on digital technology and data being stored in different locations (such as cloud services). Not all of these will be backed up to meet the needs of the school or college (for example, cloud services will only backup your data for a limited time period), so you need to have a backup plan to meet your diverse needs.听

This standard will help your school or college to:听

• recover important data and systems to continue teaching and resume normal business operations in the event of a cyber incident or attack听
• manage recovery of damaged or lost files听
• be compliant with data protection legislation听

Not meeting this standard could lead to:听

• operational impacts on the school or college due to systems and data being unavailable听
• the loss of student work which may impact on the school or college鈥檚 results听
• critical systems that support safeguarding not being available or potentially storing out of date data听
• lost, misused or damaged data听
• a breach of data protection legislation听
• unexpected costs from bringing in specialists to help recover your systems and data听

Who needs to be involved听听

The senior leadership team (SLT) digital lead will own the backup plan and work with IT support to make sure backups are being done correctly.听听

IT support will action the backup plan and will communicate this with any IT leads in your broader organisation (if applicable), such as a multi-academy trust or a local authority school, to find out if anything needs to be actioned or approved by them.听

The SLT need to prioritise which data areas would need to be recovered first in the event of a cyber incident or attack.听

The SLT digital lead and IT support will identify risks and priorities by speaking to:听

• the business professionals or the finance team听
• the designated safeguarding lead听
• the data protection officer听

If you do not have the technical expertise in-house, you will need to get advice from an external support provider or consider training for your internal IT staff to make sure they have the skills needed.听

How to meet this standard听

Your backup plan should feed into your business continuity plan and disaster recovery plan. The backup plan should be:听

• kept up to date听
• tested termly to make sure it works, or more often if there is a significant service change 鈥� speak to your IT support for further advice on how to do this听
• reviewed on an annual basis, or when there is a major change to the systems or data听

Read our standards on digital leadership and governance for more details on business continuity plans.听

Analyse where you are now听

It is useful to understand what your current backup plan looks like so that you can assess if it needs improvement.听

The SLT digital lead should ask IT support:听

• what data is currently being backed up, how often, how old it is and how it is being backed up, including data stored on all your cloud services 鈥� this information should be stored in your information asset register听and you can record it using the
• what information is not being backed up
• how often they test data that has been restored to check the backups are successful听
• how long a restoration will take and when the last test restoration was completed听
• how many copies are being kept and where they are located听
• how your backups may be affected in the event of an incident or attack听

If you do not have internal IT support, ask your service provider to explain what they are doing to help you achieve this standard.听

Plan and action how to backup and restore data in the future听

The SLT digital lead will work with your business professionals or the finance team, designated safeguarding lead, data protection officer and IT support to identify:听

• what data you backup, including what critical data and systems are needed to function as a school or college in a disaster situation听
• how long you can go without specific systems and data and how up to date they need to be to find out the priority of recovery 听
• a process for students and staff to delete or archive data on an annual basis 鈥� this will speed up recovery times by getting rid of data you no longer need听听
• how long you will keep data for 鈥� this should align with statutory duties and retention policies so that you only backup what you need听
• how you will deal with any statutory requirements, such as a freedom of information request or a data subject access request听
• how and where you will backup your data听

IT support should:听

• have at least 3 backup copies of important data, on at least 2 separate devices 鈥� at least one of these copies must be off-site (on large sites, these copies should be far enough away to avoid dangers from fire, flood, theft and similar risks)听听
• make sure that backups are immutable, this means that they cannot be changed once they have been created 鈥� this helps prevent data loss and reduces the risk of malware or ransomware being introduced into your systems when restoring data听
• choose backup methods you will use based on your school or college鈥檚 budget and the identified needs in your backup plan听
• test and log your backups termly or if there is a significant change, this should include the ability to recover and restore from backups 鈥� the NCSC has an 听
• have a policy on how frequently restorations should take place to test the backup and how this will be reported on to evidence success听
• make sure, wherever possible, that restoring data is not device specific and can be recovered to a wide range of hardware听

You should not take any physical backups offsite unless they are encrypted and stored in a secure location. Regardless of whether they are encrypted, backups should never be taken to anyone鈥檚 home. 听

When to meet this standard听

You must backup your data now. If you have not yet done so, you should develop a backup plan as soon as possible to allow you to respond quicker in a disaster situation.听

Related standards听

The following digital standards should also be considered when completing this standard.听听听

Digital leadership and governance:听听

• Include digital technology within disaster recovery and business continuity plans听
• Keep registers relating to hardware and systems up to date听

Cloud solution:听

• Make sure that appropriate data backup provision is in place听

Servers and storage:听

• All servers and related storage platforms should continue to work if any single component or service fails听

Why this standard is important听

A cyber incident or attack will often be an intentional and unauthorised attempt to access, change or damage data and digital technology. They could be made by a person, group, or organisation outside or inside the school or college.听

Everyone is responsible for and should report a cyber incident or attack to their IT support and senior leadership (SLT) digital lead.听

Following this standard means that:听

• an investigation can begin immediately which will help inform what actions a school or college need to take to deal with an incident or attack听
• the damage to data and digital technology can be limited听
• issues can be identified and resolved quickly听
• appropriate people, such as the police or IT support, can be brought in to respond to the incident or attack听

Failure to report and act quickly could lead to:听

• an increase in severity and spread of a cyber incident or attack听
• damage to data and systems听听
• a data breach which may need to be reported to the Information Commissioner鈥檚 Office (ICO)听
• other schools or colleges on your broader organisational network being impacted by the same cyber incident or attack听
• time spent wiping devices and servers to return to a previous safe state听

Who needs to be involved听

Cyber incidents or attacks can be reported by anyone to their IT support and SLT digital lead who will work closely with the data protection officer (DPO) to identify any data protection issues.听

Any formal reporting to external bodies (such as Action Fraud) will need to be done by someone appointed by the SLT digital lead and involve the:听

• SLT and headteacher or principal, who will approve a formal report and outline any impact on school or college activity听
• IT support team, who will investigate and resolve the issue听
• DPO, who will establish whether a data breach has occurred听
• designated safeguarding lead, who will review whether there are any safeguarding issues and related actions听
• governors and trustees, who will need to be informed on the risk and the actions the school or college are taking to resolve it听

If you do not have the technical expertise in-house, you will need to get advice from an external support provider or consider training for your internal IT staff to make sure they have the skills needed.听

How to meet this standard听

All students and staff have a responsibility to report cyber risk or a potential incident or attack to IT support and the SLT digital lead. 听

The SLT digital lead will need to make sure that all students and staff understand how to report a potential incident or attack and that they feel safe and comfortable to do so.听

To help action this standard, you can also visit:听

• the Department for Education (DfE) website for information on managing a data breach听听
• the National Cyber Security Centre (NCSC) website for 听

Report a cyber incident or attack internally听

As soon as IT support and the SLT digital lead have been alerted by a student or member of staff to a potential incident or attack they will need to:听

• action their cyber incident response plan which is a part of their business continuity and disaster recovery plans听
• contain the risk and make sure systems are safe and secure听
• notify those in the 鈥榳ho needs to be involved鈥� section of this standard and in line with their business continuity plan听
• capture information on the risk听
• investigate the risk and decide on the next course of action听
• report the potential incident or attack to the governing body or trustees听

Any incidents, attacks or near misses should be recorded in an internal incident report or system.听

Report a cyber incident or attack to external bodies听

Incidents or attacks where any security breaches may have taken place, or other damage was caused, should be reported to an external body.听

The SLT digital lead will be responsible for assigning someone to report any suspicious cyber incidents or attacks. This person will need to report this to:听

• Action Fraud on 0300 123 2040, or the 听
• the DfE sector cyber team at Sector.Incidentreporting@education.gov.uk听

You may also need to report to:听

• if the incident or attack causes long term school closure, the closure of more than one school, or serious financial damage听
• within 72 hours, where a high risk data breach has or may have occurred听
• your cyber insurance provider (if you have one), such as risk protection arrangement (RPA)听
• 听

You must act in accordance with:听

• Action Fraud guidance for 听
• Academy Trust Handbook Part 6, if you are part of an academy trust听
• ICO requirements for 听

Police investigations may find out if any compromised data has been published or sold and identify the perpetrator.听

When to meet this standard听

You should already be meeting this standard. If you do not have these procedures in place, then you should implement them as soon as possible.听听

Related standards听

The following digital standards should also be considered when completing this standard.听听听

Digital leadership and governance:听听

• Assign a senior leadership team (SLT) member to be responsible for digital technology
• Include digital technology within disaster recovery and business continuity plans听
• Keep registers relating to hardware and systems up to date听

Cloud solution:听

• Cloud solutions must follow data protection legislation听

Servers and storage:听

• Servers and related storage platforms must be secure and follow data protection legislation