The Department for Education has updated its cyber security standard for schools and colleges.
The update was published on 24 June 2026 and reflects new technical requirements introduced by the National Cyber Security Centre as part of the Cyber Essentials 2026 standard.
This is not a complete rewrite and the familiar areas are still there:
• risk assessments
• cyber awareness
• anti-malware
• firewalls
• user accounts
• passwords
• MFA
• security updates
• backups
• incident reporting
The important point is the direction of travel.
The DfE standard appears to be moving closer to Cyber Essentials.
For schools, that means more focus on MFA, account security, password controls, patching, approved applications, IoT devices and clear evidence.
Cyber Essentials is not just for businesses
Cyber Essentials is often seen as a business certification.
That is understandable. Lots of companies need it for contracts, insurance or supply chain requirements.
But the controls behind Cyber Essentials are not “business-only” controls.
They cover basic, practical cyber security.
That is why the DfE standard is now reflecting more of the same thinking.
For colleges, Cyber Essentials is already a requirement under funding agreements. For schools, it may not be compulsory in the same way, but the DfE standard says some schools may wish to complete Cyber Essentials as part of their cyber security activities.
My view: even where certification is optional, the Cyber Essentials controls are becoming a useful benchmark for schools.
They help answer a simple question: Are the basics being done properly?
MFA is the biggest practical change
The biggest change is around multi-factor authentication.
The previous DfE wording focused MFA on senior leaders and staff working with confidential, financial, personal and sensitive personal data.
The updated wording is broader.
MFA must now be enabled for:
• staff accounts with access to cloud services or on-site systems
• IT administrative accounts
That is a significant shift.
For many schools, MFA is already enabled for Microsoft 365 or Google Workspace. That is a good start.
But schools should not stop there.
They also need to look at:
• MIS systems
• safeguarding platforms
• finance systems
• HR and payroll systems
• remote access
• backup portals
• filtering and monitoring dashboards
• admin consoles
• cloud services used by staff
• supplier and IT provider access
The aim should be simple: Where MFA is available and practical, turn it on.
Where it is not available, record the exception and strengthen the surrounding controls.
That might mean stronger passwords, restricted access, named accounts, better logging, tighter remote access, IP restrictions, VPN controls, privileged access controls or moving the service behind a more secure sign-in method.
This is especially important for servers and older on-site systems.
MFA can be harder to implement on some server logins, legacy applications and local infrastructure. Some systems were never designed with modern authentication in mind.
That does not mean schools should ignore the requirement.
It means they need a sensible plan.
Start with cloud services and admin portals, because those are often the easiest and highest-value places to enable MFA.
Then look at remote access, admin accounts and systems that expose sensitive data.
For servers, focus on reducing the risk:
• use named admin accounts
• separate admin accounts from normal staff accounts
• restrict who can log in
• avoid shared administrator passwords
• use strong passwords or passphrases where MFA is not available
• restrict remote access
• protect VPN and remote management tools with MFA
• keep servers patched
• monitor admin activity
• remove access when it is no longer needed
The DfE standard is not asking schools to pretend old systems are easy. It is asking them to reduce the risk properly.
Passkeys get a mention
The updated standard also says passkeys may provide an alternative solution where staff use a dedicated device.
That is worth noting.
Passkeys will not suit every school setup immediately.
Schools have shared devices, supply staff, classroom machines, temporary workers, accessibility needs and staff working across more than one setting.
But it does show where sign-in security is heading.
Passwords are not disappearing overnight, but schools should expect more pressure to use safer and easier ways to sign in.
Password wording has been tightened
The updated DfE standard now says users must be authenticated with unique credentials before accessing devices, the network and services.
That addition of “the network” matters.
The new wording also says passwords must be:
• unique to the user
• protected from unauthorised access
• supported by technical controls that reduce the risk of compromise
This means schools should be looking at more than password length.
They should be checking whether systems can:
• stop repeated login attempts
• lock accounts after too many guesses
• detect suspicious sign-ins
• prevent shared accounts
• require stronger passwords where MFA is not available
• remove access quickly when someone leaves or changes role
A shared admin password in a drawer is not going to sit comfortably with this standard.
Nor is a generic login used by several people.
Account management is a shared responsibility
The updated standard also strengthens account management.
Accounts should only be created when required, privileges should be limited to what people need for their role, and access should be removed promptly when someone leaves or no longer needs it.
This is not just an IT responsibility.
IT can disable accounts, but only when they are told something has changed.
That means schools need a clear joiners, movers and leavers process involving HR, line managers, SLT, the school office, business administration and IT support.
Old staff accounts, forgotten admin accounts, supplier access, shared logins, temporary accounts and supply staff accounts are often where risk hides.
A good process should answer some simple questions:
• Who tells IT when someone leaves?
• How quickly is IT told?
• Who tells IT when someone changes role?
• Are temporary and supply accounts given an end date?
• Are old supplier accounts reviewed?
• Are admin accounts separate from day-to-day accounts?
• Are shared accounts avoided wherever possible?
• Can SLT access emergency admin credentials if IT support is unavailable?
A termly account review should not be a blame exercise.
It should be a simple check that access still matches the people, roles and suppliers the school actually has.
Approved applications and secure software now matter more
Another useful change is the stronger wording around applications.
The standard now says schools should maintain a current list of approved applications on the contracts register, remove unnecessary software, only install applications from known suppliers, and make sure custom-built or commissioned applications are developed securely.
This is sensible – schools now use a large mix of apps, browser tools, cloud platforms, learning tools, finance systems, safeguarding systems and AI-powered services.
Some are centrally managed. Some are bought by departments. Some are free. Some are installed quietly because they solve a short-term problem. That creates risk.
A simple approved applications list helps schools understand what they use, who owns it, what data it holds, whether it is supported, when it renews and whether it still has a purpose.
This should link back to the contracts register, asset register, data protection work and cyber risk assessment.
IoT devices are explicitly mentioned
The updated standard now refers to all network-connected devices, including IoT.
That could include:
• CCTV
• access control
• printers
• smart boards
• heating controls
• sensors
• door entry systems
• other connected equipment
These devices are often overlooked because they do not look like traditional computers.
But if they are connected to the network, they need to be securely configured, kept up to date and protected by firewalls.
For schools, this means asking some awkward but necessary questions.
Who manages these devices?
Are default passwords changed?
Are updates being applied?
Are they separated from critical systems?
Can suppliers access them remotely?
Are they recorded in the asset register?
If nobody owns them, they become a blind spot.
The 14-day patching rule is still one of the most important requirements
The 14-day vulnerability fix requirement was already in the DfE cyber security standard before this June update, so it is not brand new.
It is still one of the most important requirements.
The standard says IT support must complete vulnerability fixes for operating systems, applications and firmware within 14 days of release where the vulnerability is critical, high risk, CVSS 7.0 or above, or where the vendor does not provide a severity rating.
It also makes clear that vulnerability fixes are not just traditional patches.
They can include:
• patches
• updates
• configuration changes
• registry changes
• vendor-provided scripts
That means schools need a patching process that covers more than Windows updates.
It should include:
• operating systems
• browsers
• common applications
• firmware
• network devices
• firewall firmware
• servers
• cloud-managed systems
• third-party applications
• devices used away from school
The standard also says high-risk devices may need to be isolated if patches are not available.
That is a big clue. – patching is not just “install updates when convenient”. It is a risk management process.
Backups still need proper testing
Backups are still a key part of the DfE standard.
This is an area where schools can feel safer than they really are.
A backup report saying “successful” is useful, but it is not the same as proving recovery works.
Schools should be able to answer:
• What is backed up?
• How often is it backed up?
• Where is it stored?
• Is there an offline or immutable copy?
• Can ransomware delete or encrypt the backups?
• When was the last restore test?
• What was restored?
• How long did it take?
• Who checked the restored data?
• What would be restored first after a serious incident?
Backups are not useful because they exist. They are useful when they can be restored.
What evidence should schools keep?
Schools should keep simple evidence that shows the standard is being managed, not just discussed.
Useful evidence includes:
• a cyber risk assessment reviewed at least annually
• notes from termly cyber risk reviews
• a list of systems where MFA is enabled
• a list of MFA exceptions and compensating controls
• a termly user account review
• joiners, movers and leavers process notes
• evidence that IT is told promptly when access needs to change
• a list of admin accounts and who owns them
• a patching report showing critical and high-risk fixes
• an asset register covering servers, laptops, desktops, network devices and IoT
• an approved applications list
• backup test records
• cyber incident response plan
• staff training records
• governor or SLT review notes
This does not need to become a paperwork mountain.
A simple evidence folder with reports, screenshots, review notes and supplier evidence is much better than vague assurances.
Questions to ask your IT provider
If your school uses an external IT provider, these are sensible questions to ask.
Are staff cloud accounts protected by MFA?
Are admin portals protected by MFA?
Are IT administrative accounts protected by MFA where possible?
Where MFA is not available, what stronger controls are in place?
Are admin accounts separate from normal working accounts?
How quickly does IT disable or amend access once they are notified?
Do temporary, supply and contractor accounts have review dates or end dates?
Can we evidence that account access is reviewed termly?
Can you show which critical and high-risk updates were applied within 14 days?
Does patching include firmware, browsers, third-party applications and network devices?
Do we have a list of approved applications?
Are old or unnecessary applications removed?
Are IoT devices recorded and secured?
When were backups last tested?
Could ransomware delete or encrypt the backups?
Do we have an incident response plan?
If we had a cyber incident tomorrow, who would do what first?
These are not trick questions.
They are practical questions that help school leaders understand whether the basics are under control.
A simple action plan for schools
If you are not sure where to start, use this as a practical action plan.
1. Map your systems
List the systems staff use to access school data.
Include Microsoft 365, Google Workspace, MIS, safeguarding, finance, HR, payroll, backup, remote access, filtering, monitoring, governor portals and any other cloud services.
2. Check MFA
For each system, record whether MFA is available, whether it is enabled, who it applies to and what exceptions exist.
Start with cloud services and admin portals.
Then review remote access, privileged accounts and systems holding sensitive data.
For older on-site systems and servers, do not pretend MFA is always simple. Where MFA is not available or practical, record the reason and put stronger controls in place.
3. Review admin access
Admin accounts should be named, protected by MFA where possible, and used only when needed.
Day-to-day work should not be carried out using admin accounts.
External IT provider access should also be reviewed.
4. Remove old access
Check for leavers, role changes, old supplier accounts, test accounts, temporary accounts and shared accounts.
This needs to be a joint process.
HR, line managers, SLT, the school office and business administration need to tell IT when someone leaves, changes role or no longer needs access.
IT can then remove or amend access promptly.
Temporary and supply staff accounts should have clear end dates wherever possible.
This should become a termly routine, not something that only happens after a problem.
5. Check patching evidence
Ask for evidence that critical and high-risk fixes are being applied within 14 days.
Make sure this covers operating systems, applications, firmware and network devices.
6. Build an approved applications list
Create a simple list of approved applications.
Record what each application does, who owns it, what data it uses, whether it is still needed and when it renews.
7. Find forgotten devices
Check for network-connected devices that may not appear in normal IT reports.
This could include CCTV, printers, access control, smart boards, sensors and heating systems.
If they are connected, they need to be recorded and secured.
8. Test recovery
Do not rely on backup reports alone.
Test whether files, emails, systems or servers can actually be restored.
Record the test, the result and any issues found.
9. Keep simple evidence
Governors and SLT do not need technical noise.
They need clear evidence that the school understands the risk and is taking proportionate action.
A simple evidence folder is enough.
Include MFA status, account reviews, patching reports, backup test results, asset lists, training records and incident response notes.
10. Review it termly
Cyber security should not be a once-a-year scramble.
A short termly review is far better than trying to fix everything when an audit, insurance renewal or incident lands.
This is school resilience, not just IT
The best schools will not treat this as an IT checklist.
They will treat it as school resilience.
Can you teach?
Can you access safeguarding records?
Can you pay staff?
Can you communicate with parents?
Can you recover if something goes wrong?
Cyber security in schools is not about making technology complicated.
It is about keeping the school running, protecting children’s data and giving leaders confidence that the basics are being looked after properly.
The DfE update is another reminder that those basics are getting firmer.
MFA, patching, secure accounts, approved software, backups and clear evidence are no longer nice extras.
They are becoming the expected standard.
Need help checking where your school stands?
We can review your school against the updated DfE cyber security standard and give you a plain-English action plan.
We will look at MFA, account security, patching, backups, approved applications, admin access, supplier access and evidence.
No scare tactics.
No enterprise-level waffle.
Just calm, practical cyber security that helps your school understand where it stands and what to do next.
