As cyber attacks against schools continue to make headlines, a reasonable question keeps surfacing: are schools properly included in the UK Government’s cyber strategy?
The honest answer is: not explicitly.
What the Cyber Action Plan covers
The Government’s Cyber Action Plan aims to improve cyber resilience across central government and parts of the wider public sector. Its focus includes accountability, visibility of risk, incident response and recovery.
All sensible priorities.
However, the plan is largely framed around organisations that sit within established government assurance and reporting structures. Schools are not specifically named.
Where schools actually sit
Schools, academies and Multi-Academy Trusts continue to rely primarily on:
DfE Cyber Security Standards
Sector-specific guidance
The Risk Protection Arrangement (RPA)
These provide direction, but they are not the same as being embedded within national cyber assurance frameworks, and they do not come with ring-fenced funding.
The quiet withdrawal of central support
Alongside this, schools have recently seen the withdrawal of several NCSC-provided services that played a meaningful role in prevention:
DMARC reporting
Web Check
Mail Check
These weren’t “nice to haves”. They helped schools understand exposure, reduce email abuse and improve basic cyber hygiene.
With these services now withdrawn, schools are being pushed towards paid alternatives, adding yet another cost pressure – often without additional funding or guidance on how to replace what’s been lost.
The risk hasn’t gone away. The bill has simply been passed downwards.
Why this matters now
Schools are no longer low-value targets.
They hold safeguarding information, personal and financial data, and operational details that underpin day-to-day safety. When incidents involve stolen site maps or floor plans, cyber risk starts to overlap directly with physical security and safeguarding.
At that point, cyber security stops being “just IT”.
Training and funding realities
Most schools are doing what they’ve been asked to do, under significant strain.
Training is often limited to a single annual session. Budgets are tight, rarely ring-fenced for cyber. Leadership teams are juggling safeguarding, staffing, inspections and compliance, while threat actors continue to raise their game.
When incidents happen, schools are told:
Not to pay ransoms
To recover quickly
To reassure parents, regulators and communities
But they are not always given the tools, funding or structural support needed to prevent the crisis in the first place.
This isn’t about blame
It’s important to be clear: this is not a criticism of schools, staff, governors or leadership teams.
It’s a recognition that expectations are rising while central support is quietly shrinking.
If schools were treated as critical during COVID, and they were, then it’s reasonable to ask whether their cyber resilience should now be treated with the same seriousness as other public infrastructure.
The conversation we need
The Cyber Action Plan is a step forward.
DfE guidance helps.
But withdrawing preventative services while cyber risk escalates leaves schools exposed in the middle, expected to do more, with less.
Closing that gap means:
Treating cyber resilience as part of safeguarding
Funding it properly
Training meaningfully
Recognising the reality schools are operating in
Until then, schools will continue to carry a level of risk that no safeguarding-led organisation should be expected to shoulder alone.
