School cyber security: a practical leadership checklist

Start with the consequences for the school

A cyber incident can become a school operations problem very quickly. Staff may lose access to attendance, contact information, teaching materials or payments. Begin the discussion with those dependencies rather than a list of security products. Ask what must continue, how long the school could manage without each service and what alternative process is available.

Give a senior leader responsibility for coordinating this work with IT support, safeguarding and data protection colleagues. Governors or trustees need an understandable account of the risks and progress, not unrestricted access to technical logs. The National Cyber Security Centre's school governor questions provide a useful basis for that conversation.

For schools and colleges in England, the DfE cyber security standard is an important reference. Check its current requirements and how they apply to the setting. The practical priorities below are a way to organise work; they are not a certification or a declaration that the school complies with every applicable obligation.

Know what needs protecting

Maintain a current list of important systems, their owners and the organisations that support them. Include cloud services, email, websites, finance, safeguarding systems, devices and network equipment. Record support dates and contract dependencies so a system does not quietly become unsupported.

For each service, ask who can administer it, how access is granted, how access is removed and how the school would recover it. Accounts created for a short project or temporary employee should not remain privileged indefinitely. Where suppliers provide support, document their access and the process for changing or ending that relationship.

Protect accounts and everyday work

Prioritise stronger authentication for administration, remote access, email and other sensitive services. Separate routine work from privileged administration so an ordinary browsing session does not automatically carry extensive control over school systems. Our multi-factor authentication guide covers a manageable rollout.

Make secure practice achievable. Staff need an approved way to store credentials, share necessary work and obtain access without passing around passwords. Give the help desk a reliable identity-checking process for resets. A person who sounds urgent on the telephone should not be able to bypass that process.

Maintain supported software and a dependable update process. Review failures and exceptions rather than assuming that an enabled automatic-update setting has solved the problem. Include routers, wireless equipment, printers and specialist devices as well as laptops.

Make suspicious activity easy to report

Tell staff how to report a suspicious message, unexpected sign-in prompt, missing device or unusual system behaviour. Use a route they can find without searching a policy folder. Offer an alternative contact method if school email is unavailable.

Respond constructively when someone reports a mistake. The useful question is what happened and what action is needed, not whether the employee should have noticed earlier. Collect the information IT support needs, preserve relevant evidence and avoid asking staff to investigate potentially harmful links themselves.

Use short, realistic training examples connected to school work: a changed supplier bank account, an urgent request for pupil information or a fake shared document. Financial approval and verification procedures still matter even when email security is strong.

Prove that recovery works

Backups should cover the data and configurations needed to restore important services. Establish who checks them, what is isolated from normal accounts and how restoration is tested. A successful backup notification does not prove that a usable school service can be recovered. See school backup and recovery.

Keep a practical incident response plan available outside the systems it describes. Exercise a scenario in which email, shared storage and the usual supplier contact list are unavailable. Include decisions about attendance, parent communications and safeguarding escalation, not just server restoration.

Review a small set of useful evidence

A termly leadership review could consider outstanding unsupported systems, privileged-access exceptions, unresolved update failures, staff reporting patterns and the last recovery exercise. Assign owners and dates to significant gaps. Avoid dashboards that show only a reassuring overall score without explaining what remains exposed.

Ask whether proposed spending addresses a specific risk and how success will be demonstrated. Sometimes the next useful step is a configuration correction, clearer ownership or a tested process rather than another subscription. Security improves when technical controls and everyday school procedures reinforce each other, and when leaders can see which actions remain unfinished.