What every school should be doing now to meet the DfE’s 2030 digital standards and why academy trustees must treat this as a governance issue
2030 sounds a long way off. In school IT terms, it really isn’t.
A broadband contract might run for several years. Wireless networks and switches can stay in place for much longer. Servers, laptops, filtering systems and other technology all have their own replacement cycles.
Then there are budgets to agree, suppliers to manage and, quite often, years of technology bought at different times that somehow needs bringing together into one sensible plan.
That is why schools shouldn’t look at the Department for Education’s 2030 digital standards and think:
“We’ve got four years. We’ll sort that later.”
The DfE says all schools and colleges should be working towards meeting six core digital and technology standards by 2030. This isn’t something that only applies to large multi-academy trusts. It applies across schools and colleges.
The six core standards are:
broadband internet
wireless networks
network switching
digital leadership and governance
filtering and monitoring
cyber security
There is an important bit that can easily get missed – 2030 is the destination for the six core standards as a whole.
It doesn’t mean schools should wait until 2030 before dealing with cyber security, backups, MFA, filtering or business continuity.
In several areas, DfE’s guidance says schools should already have controls in place.
This isn’t really an IT project
That is probably the biggest change of mindset needed.
I have spent a lot of years working with schools where technology naturally became “the IT person’s job”.
The server is IT.
The Wi-Fi is IT.
Microsoft 365 is IT.
Cyber security is IT.
Until something goes wrong.
If a ransomware attack means staff cannot access safeguarding information, that is no longer simply an IT problem.
If payroll details are changed following a compromised email account, it becomes a finance problem.
If filtering fails to protect pupils from harmful content, it becomes a safeguarding problem.
If the MIS, telephones, internet connection and cloud systems disappear on a Monday morning, it becomes a business continuity problem very quickly.
That is why digital technology increasingly belongs on the leadership and governance agenda.
DfE’s own digital leadership and governance standard reflects this. It expects schools to have a senior leadership team member responsible for digital technology, keep appropriate registers up to date, include technology within disaster recovery and business continuity arrangements, and develop a digital technology strategy that is reviewed at least annually. Governors or trustees should support and challenge those plans.
So the question shouldn’t simply be: “Is the IT working?”
It should be: “Do we know whether our technology is secure, resilient, appropriate for what the school needs and being managed against an agreed plan?”
Those are very different questions.
Start by finding out where you are now
Schools do not need to start by buying something, in fact, I would argue that buying products before understanding the gaps is the wrong way around.
The sensible starting point is a baseline.
DfE provides its Plan technology for your school service for exactly this purpose. Schools and trusts can complete self-assessments, receive recommendations and track progress towards meeting the standards.
That gives leaders something far more useful than a vague statement that “IT looks OK”.
It provides a starting point.
From there, schools can identify what is already compliant, what needs improving, what needs budgeting for and what can sensibly wait until the next replacement cycle.
Meeting the standards doesn’t necessarily mean ripping everything out and starting again.
For most schools, the sensible approach will be a planned journey.
Some things shouldn’t wait until 2030
This is particularly important around cyber security.
The current DfE cyber security standard contains some very practical expectations.
Schools should conduct a cyber risk assessment annually and revisit it every term. Cyber risks should feed into the risk register and business continuity planning, with significant issues being reported to governors or trustees.
Multi-factor authentication should already be enabled for staff accessing cloud services or remotely accessing on-site systems, as well as for IT administrator accounts.
High-risk security vulnerabilities should be fixed within 14 days where the vendor classifies them as critical or high risk, where the CVSS v3.1 score is 7.0 or above, or where the vendor provides no severity rating.
Backups need more thought than simply asking:
“Do we have a backup?”
DfE recommends the familiar 3-2-1 approach: at least three copies of important data, on at least two separate devices, with at least one copy off site. The guidance also says backups should be immutable and that recovery should be tested and logged at least termly.
That last bit is important.
A green tick saying “Backup successful” doesn’t prove that you can get the school running again.
A restore test does.
There should also be a cyber incident response plan.
Who makes the decisions?
Who contacts the IT provider?
Who contacts the DPO?
What happens if Microsoft 365 is unavailable?
Where is the plan stored if nobody can log in?
Which systems need recovering first?
Who has authority to isolate systems or accounts?
Those conversations are much easier to have before the incident.
Filtering and monitoring cannot wait either
Filtering and monitoring is one of the six 2030 core standards, but schools should not interpret that as a 2030 implementation date.
Schools and colleges already have statutory responsibilities for keeping children safe online.
DfE says governing bodies and proprietors have overall strategic responsibility for filtering and monitoring and should seek assurance that suitable systems are in place. Provision should be reviewed at least once every academic year, with the review involving senior leadership, the DSL, IT support and the responsible governor.
This has become even more important as the technology pupils use changes.
Websites are no longer made up entirely of static pages that can simply be allowed or blocked. AI-generated content, cloud applications and personalised services make filtering and monitoring more complex.
Again, governors do not need to understand how the filtering system works technically.
They do need to know that somebody competent does.
The infrastructure standards matter too
Cyber gets a lot of the attention, but broadband, wireless and network switching are there for a reason.
Schools now depend on connectivity for almost everything.
Teaching resources.
Cloud applications.
Email.
Safeguarding systems.
MIS platforms.
Telephony.
Filtering.
Backups.
Finance.
Exams.
A network that “mostly works” isn’t necessarily a resilient network.
The broadband standard, for example, includes resilience and recommends a backup connection to maintain continuity of service.
Schools therefore need to understand the age, capacity, support status and resilience of their network infrastructure.
If the wireless network or switches will need replacing between now and 2030, that should already be visible in the school’s technology strategy and financial planning.
Otherwise, 2030 could become a very expensive year.
Why trustees should be asking about this now
For academy trusts there is an additional reason this belongs firmly on the board agenda.
The Academy Trust Handbook 2026, which comes into effect on 1 October 2026, specifically tells trusts they should be working towards meeting the DfE digital and technology standards and the six core standards by 2030.
The Handbook’s wording matters.
It describes “should” as minimum good practice which trusts should apply unless they can demonstrate that a different approach better suits their circumstances.
It also says academy trusts must be aware of the risk of cybercrime, put proportionate controls in place and take appropriate action following a cyber security incident.
And from 1 October 2026, the Handbook is explicit that academy trusts must not pay ransom or extortion demands, including ransomware demands.
That takes cyber security well beyond a technical discussion between the network manager and the IT provider.
It is governance.
Trustees don’t need to configure a firewall.
They don’t need to understand how a VLAN works.
And I certainly wouldn’t expect them to know the CVSS score of this month’s Microsoft vulnerabilities.
But they do need assurance.
What should governors and trustees actually ask?
| Board question | The evidence I would expect to see |
|---|---|
| Where are we against the six DfE core standards? | A documented assessment, ideally using DfE’s Plan technology service, with gaps and actions identified. |
| Who is responsible for digital technology at senior leadership level? | A named SLT digital lead with clear responsibilities and reporting arrangements. |
| What are our biggest current cyber risks? | An up-to-date cyber risk assessment, with significant risks reflected in the organisation’s risk register. |
| Are staff and administrator accounts protected properly? | Evidence of MFA coverage, including cloud, remote-access and administrative accounts. |
| Are critical security updates being installed quickly enough? | Reporting showing that high-risk vulnerabilities are being identified and addressed within the required timescales. |
| Could we actually recover from ransomware? | Evidence of backup arrangements and recent successful restore tests, not simply screenshots showing that backup jobs completed. |
| When did we last test our cyber incident or disaster recovery plan? | A documented exercise or test, lessons learned and actions arising from it. |
| When was filtering and monitoring last reviewed? | A documented annual review involving safeguarding, leadership, IT and the responsible governor. |
| What technology will need replacing before 2030? | An asset register, lifecycle plan and realistic budget forecast. |
| Are we relying on any single supplier or service that could stop the school operating? | A clear understanding of critical suppliers, dependencies and contingency arrangements. |
None of those questions require the board to become technical, but they do require the board to govern.
Don’t ask your IT provider whether everything is OK
There is another subtle difference worth making.
“Is everything OK?” is a terrible governance question.
It will usually get the answer: “Yes.”
Ask for evidence instead.
When was the last restore test?
Show us the MFA coverage.
Which devices are unsupported?
What remains unpatched?
When was the cyber risk assessment last reviewed?
What would stop us opening the school tomorrow if it failed today?
Which actions from the DfE self-assessment remain outstanding?
That is not about catching anybody out.
Good IT teams and good IT providers should welcome sensible questions because it helps them get risks understood, prioritised and funded.
Governance should create clarity, not blame.
2030 needs a roadmap, not a panic-buying exercise
For many schools, budgets are already stretched.
The answer isn’t to spend money on everything at once.
It is to understand where you are, identify the biggest risks and then create a sensible roadmap.
Some actions might cost nothing.
Assigning an SLT digital lead costs nothing.
Reviewing roles and responsibilities costs nothing.
Testing the incident plan costs very little.
Reviewing administrator accounts may uncover accounts that should have disappeared years ago.
Other improvements will need investment: network replacements, wireless upgrades, backup services, security tools, resilient connectivity or replacement devices.
Those are much easier to fund when they appear in a multi-year strategy rather than as an emergency purchase after something fails.
That is what good digital governance should achieve.
2030 isn’t the starting line
The DfE’s 2030 ambition gives schools a useful direction of travel.
But I wouldn’t focus too heavily on the date.
For me, the more useful question is:
If a serious technology or cyber incident happened tomorrow, how confident are we that the school could continue operating and recover safely?
If the answer is based on evidence, recent testing and a clear plan, you’re probably heading in the right direction.
If the answer is:
“I think our IT company sorts that…”
there is probably some work to do.
And that work shouldn’t wait until 2030.
Need help understanding where your school stands?
Black Swan Cyber Security Solutions works with schools and education providers to turn DfE cyber security and digital technology requirements into practical actions.
That can be as simple as reviewing your existing arrangements, identifying gaps and helping you build a realistic roadmap rather than selling you another pile of technology.
If you would like a second pair of eyes on your school’s cyber security, backups, resilience or progress towards the DfE standards, get in touch for a no-obligation conversation.
