A cyber security framework built for schools, by someone who understands schools
Whether you’re a headteacher managing limited budgets, an IT coordinator handling hundreds of devices alone, or a MAT executive overseeing multiple sites, this framework gives you a clear path to meeting DfE standards and protecting your school community without the complexity.
DfE Cyber Security Standards for Schools and MATs
Most schools are not ignoring cyber security. They are just stretched. The guidance is scattered, time is short, and the person carrying it often has ten other things on their plate. This pulls the DfE standards into one practical view and shows what good looks like in a real school setting.
What the DfE actually expects
- Multi-factor authentication on key systems
- Tested, isolated backups that can be restored
- Admin access tightly controlled and reviewed
- Staff trained to spot phishing and report concerns
- Supported software and prompt patching
- A clear cyber incident response plan
- Regular risk review and leadership oversight
What we often see in schools
- MFA switched on... but not for admin accounts
- Backups running... but no restore testing
- Antivirus installed... but no visibility
- Accounts in place... but leavers still active
- Policies written... but not embedded day to day
How we help schools make this practical
DfE gap analysis
A clear view of where you stand against the standards and what needs attention first.
Cyber Essentials support
Support with the technical and practical work needed to meet core requirements and show progress.
Endpoint and identity protection
Protection that goes beyond basic antivirus, helping spot and contain real threats earlier.
Backup and recovery planning
Making sure backups are properly set up, properly tested, and usable when you actually need them.
Six practical pillars for school cyber security
This is easier to tackle when you break it down. These six areas cover the parts that tend to matter most in schools and MATs.
Leadership, governance and risk
Good school cyber security starts with ownership. Someone in leadership needs to be accountable, risks need to be reviewed, and cyber needs to sit on the risk register.
Technical foundations
Firewalls, anti-malware, patching, access control and supported software all need to work together. Tools alone do not solve the problem if they are badly configured or poorly monitored.
Identity and access control
User accounts, permissions, MFA and leaver processes matter more than many schools realise. A compromised account is often the easiest route into a school environment.
Backups and recovery
Backups should not just exist. They need to be isolated, tested and tied to a realistic recovery plan so the school can get back to teaching quickly after an incident.
Staff awareness and behaviour
School staff are busy, trusted and often under pressure. Training needs to be practical, relevant and repeated so people know how to spot and report problems early.
Incident response and reporting
When something goes wrong, speed matters. Schools need a clear response plan, clear roles, and confidence about who needs to be told and when.
Many schools use Cyber Essentials as a sensible way to tighten the basics. It is not mandatory for schools, but it lines up well with the DfE standards and gives you a useful benchmark.
The DfE cyber standard at a glance
The DfE standards are much easier to work with when they’re laid out clearly. This gives you a quick way to see what’s in place and where the gaps sit.
| DfE standard | What it means in practice | Common gap |
|---|---|---|
| Risk assessment | Review cyber risks annually, revisit termly, assign ownership and keep cyber on the risk register. | No regular review, or too much reliance on informal knowledge. |
| Training and awareness | Train staff, students and relevant governors so they know how to spot risks and report them early. | Training happens once a year but is not reinforced in practice. |
| Firewalls and anti-malware | Protect the network boundary and ensure endpoint protection is in place, managed and monitored. | Basic protection exists, but monitoring and visibility are limited. |
| User accounts and access | Use role-based access, remove leavers promptly, and apply MFA where risk is highest. | Too many admin rights and weak joiner-mover-leaver processes. |
| Licensing and patching | Use supported software and apply important security updates within the required timeframes. | Legacy systems remain live because they are hard to replace. |
| Backups | Follow the 3-2-1 approach, test restores termly and ensure backups are protected from tampering. | Backups are assumed to work, but restore testing is rare. |
| Reporting cyber attacks | Have a response plan, capture incidents internally and know when to report to DfE, ICO and Action Fraud. | No clear plan until an incident is already disrupting teaching. |
Who usually finds this useful
This tends to land with the people carrying the risk, the oversight, or the day-to-day reality of keeping school systems running.
Headteachers
Understand the risk, the accountability and the practical steps needed without getting lost in technical detail.
IT leads
Use the framework to prioritise effort, tighten controls and show progress against DfE expectations.
Governors and trustees
Get a clearer view of what good looks like so you can ask better questions and provide better oversight.
MAT leadership
Create a more consistent approach across multiple schools without losing sight of local differences and constraints.
If you are wondering where to begin
- Review your position against the DfE standards
- Identify where controls exist but are inconsistent
- Prioritise access control, backups and patching first
- Make sure someone in leadership owns cyber risk
- Test your backups and incident response plan
Not sure how close you are to the DfE standards?
We can help you get a clearer picture of where things stand, where the gaps are, and what is worth fixing first. No scare tactics. No overkill. Just practical help for schools and MATs that want to tighten things up properly.
School Cyber Security Hub
Explore all our cyber security guidance and services for schools and multi-academy trusts. Start with the main hub or jump straight to the resources you need.
View Schools & MATs Overview →
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.
Stay ahead of cyber threats - Subscribe to the Black Swan newsletter
Protect your school or business with expert advice tailored to schools and small businesses. Get the latest cyber threat insights, practical data protection tips, and guidance on password security, ransomware prevention, and compliance – all delivered straight to your inbox.
Join the Black Swan community today and take charge of your cyber security.
Click here to preview an example newsletter and see what you’ll gain by subscribing!