The Complete School Cybersecurity Guide: DfE Standards, Ransomware Defence and GDPR Compliance

Step 1: Understand What the DfE Standards Require

The DfE Cyber Security Standards (January 2023) set out the UK government's expectations for all schools and colleges in England. Governors are accountable for meeting these standards. The five key areas are: governance (policies, governor engagement, risk management); protection (MFA, patching, firewalls, access control); response (incident response plan, staff training); recovery (tested backups, business continuity); and ecosystem (third-party supplier oversight). Start by assessing your school against the DfE standards. The NCSC's Schools Cyber Health Check is a free tool that maps your current posture against the required controls and identifies gaps.

Step 2: Achieve Cyber Essentials Certification

Cyber Essentials is the NCSC's baseline cybersecurity certification, covering five technical controls: firewalls, secure configuration, access control, malware protection, and patch management. The DfE standards build on Cyber Essentials, and achieving certification demonstrates that your school has the basic technical controls in place. For most schools, Cyber Essentials should be the first formal certification to pursue. It provides a structured framework for improvement, independent verification, and increasingly is required by cyber insurers as a condition of cover. Costs start from around £300 for a self-assessment.

Step 3: Deploy MFA on All Staff Accounts

Multi-factor authentication on all staff accounts — email, MIS, remote access, financial systems — is the single most effective control for preventing account takeovers. The DfE standards require it. The NCSC estimates MFA prevents over 99% of password-based account takeovers. If your school does nothing else from this guide, deploy MFA. For Microsoft 365 Education users, enable security defaults (which enforce MFA) or configure conditional access policies. For Google Workspace for Education, enforce 2-Step Verification for all staff accounts. Both are free configuration changes.

Step 4: Implement a Backup Strategy

Follow the 3-2-1 backup rule: three copies of data, on two different media types, with one offsite or offline copy. Ensure your MIS database, financial records, and critical documents are covered. Most importantly, test your backups — actually restore a sample of files quarterly to verify the process works. Ransomware attacks reveal backup failures that were previously unknown. Do not rely on Microsoft 365 or Google Drive synchronisation as your backup strategy. Dedicated backup solutions for cloud platforms maintain independent copies that ransomware cannot compromise through synchronisation.

Step 5: Train Staff and Establish an Incident Response Plan

Annual security awareness training for all staff — covering phishing recognition, password security, and what to do if they suspect an incident — is required by the DfE standards. The NCSC provides free training materials through its eLearning platform. Simulated phishing exercises test whether training is effective. Your incident response plan should specify: who to contact in the first hour of an attack; how to isolate affected systems; how to report to the NCSC and ICO; how to communicate with parents and staff. Practice the plan — a tabletop exercise once a year ensures staff know what to do before a real incident occurs.

Step 6: Manage Third-Party and EdTech Vendor Risk

Schools share pupil data with dozens of EdTech vendors. Under UK GDPR, the school remains accountable for that data. Ensure every vendor processing pupil personal data has a signed Data Processing Agreement. Review vendors' security certifications. Minimise what data you share. Monitor vendors for security disclosures. The MOVEit breach (2023), Pearson breach (2018), and Capita breach (2023) all demonstrate that supply chain risk is real for education. Build EdTech vendor due diligence into your procurement process.

Frequently Asked Questions