DfE Cyber Security Standards Checklist for Schools: Evidence Your Compliance
The DfE Cyber Security Standards (January 2023) set out what England's schools and colleges must have in place — but they do not always make it clear what evidence governors and IT leads should be able to produce. This checklist translates each DfE standard into a practical action with the evidence you need to demonstrate compliance. Use it to assess your current position, identify gaps, and build the documentation trail that governors, Ofsted, and the ICO would expect to see.
DfE Cyber Security Standards: five domains, dozens of specific requirements — this checklist translates each into an evidenceable action for school governors and IT leads.
Domain 1: Governance
The DfE requires schools to demonstrate that cybersecurity is governed at board level, with documented policies and regular risk reporting.
- [ ] Information security policy — documented, approved by the governing body, reviewed in the last 12 months. Evidence: signed policy document with governor approval minutes.
- [ ] Risk register entry — cybersecurity included in the school's risk register with a current risk rating. Evidence: risk register with cybersecurity entry, governor meeting minutes discussing risk.
- [ ] Governor briefing — governing body receives regular cybersecurity updates. Evidence: governor meeting agenda and minutes showing cybersecurity discussion.
- [ ] Designated cybersecurity lead — named person responsible for cybersecurity (IT lead, business manager, or headteacher). Evidence: named in policy and organisational chart.
Domain 2: Protection
Technical controls demonstrating that the school's systems, devices, and accounts are protected against common attacks.
- [ ] MFA deployed on all staff accounts — email, MIS, remote access, financial systems. Evidence: Microsoft 365 security defaults enabled or conditional access policy configuration screenshot.
- [ ] Patching within 14 days — documented patching process for all devices. Evidence: patch management log or IT provider patching report.
- [ ] Boundary firewall — internet-facing firewall configured with unnecessary ports closed. Evidence: firewall configuration review from IT provider.
- [ ] Access control — staff have only the access they need; admin accounts separate from daily-use accounts. Evidence: access control policy and user account review.
- [ ] Malware protection — up-to-date antivirus on all in-scope devices. Evidence: antivirus management console report.
Domain 3: Response
Evidence that the school has an incident response capability and that staff can recognise and report incidents.
- [ ] Incident response plan — documented, tested in the last 12 months, accessible offline. Evidence: the plan document; tabletop exercise record or test date.
- [ ] Staff security training — all staff have completed security awareness training in the last 12 months. Evidence: training completion records.
- [ ] ICO breach procedure — documented procedure for 72-hour ICO notification. Evidence: GDPR breach procedure document.
- [ ] Incident reporting channel — staff know who to report suspected incidents to. Evidence: staff briefing records; incident reporting procedure in acceptable use policy.
Domain 4: Recovery
Evidence of backup capability that could allow the school to recover from a ransomware attack without paying the ransom.
- [ ] Backup policy — documented backup schedule covering MIS, financial systems, and critical data. Evidence: backup policy document.
- [ ] Offsite/offline backup — at least one backup copy not connected to the school network. Evidence: backup solution configuration; cloud backup provider details.
- [ ] Backup restore test — successful restore test in the last 6 months. Evidence: test record with date, systems tested, and outcome.
- [ ] Business continuity plan — documented plan for operating during system outages. Evidence: BCP document.
Domain 5: Ecosystem (Third-Party Suppliers)
Evidence that the school manages the security risk from EdTech vendors and other third-party suppliers.
- [ ] Vendor register — list of all suppliers processing personal data on behalf of the school. Evidence: ROPA or vendor register.
- [ ] DPAs in place — Data Processing Agreements signed with all vendors processing pupil personal data. Evidence: signed DPA documents.
- [ ] Vendor security assessment — evidence of security due diligence for significant vendors. Evidence: vendor security questionnaires or certifications.
- [ ] Cyber Essentials certification — achieved or plan in place to achieve. Evidence: Cyber Essentials certificate or project plan.
Frequently Asked Questions
How should schools present this evidence to governors?
An annual cybersecurity report to governors should summarise progress against the DfE standards using a traffic light or RAG rating, with specific evidence for each domain. The report should be presented by the IT lead or business manager and include any incidents from the past year, the current Cyber Essentials status, and the plan for any remaining gaps. This creates a documented record of governor engagement that satisfies the DfE's accountability expectations.
Can this checklist be used as evidence of DfE compliance?
This checklist is a framework for identifying and documenting evidence — it is not itself evidence of compliance. Completing the checklist and noting which evidence exists and which is missing gives a clear gap assessment. The actual evidence (policies, configuration screenshots, training records, backup test logs) is what demonstrates compliance to the DfE, Ofsted, or the ICO if required.
How often should schools complete this checklist?
Annually as a minimum — timed to align with Cyber Essentials renewal and the governing body's annual review of the information security policy. Schools should also review relevant sections when significant changes occur: new IT systems, network changes, new cloud services, or a security incident.
Get help evidencing DfE standards compliance for your school
Kyanite Blue specialises in cybersecurity for iGaming operators. MGA-licensed operators across Malta trust our stack.
Get in touchReady to secure your iGaming operation?
MGA-licensed operators across Malta trust Kyanite Blue.