Network and data security standards

The risk of cyber attacks targeting schools has increased significantly in recent years, making it essential for schools to establish a clear and structured strategy for managing network and data security. A well-defined strategy ensures that systems are protected, sensitive information remains secure and that schools meet their obligations under data protection and safeguarding requirements.

An effective strategy should set out how the school will monitor and test its network and digital infrastructure, protect critical data such as learner and financial records, and identify the measures in place to prevent cyber threats. It should also define the school’s approach to managing and responding to security incidents, ensuring that staff know how to act quickly and appropriately when risks arise. Clear roles and responsibilities for maintaining network and data security must be established so that accountability is understood across the organisation.

Schools, supported by their local authority, should confirm how they are included within wider authority‑level network and data security strategies, ensuring alignment with centralised protections and monitoring. Schools that do not receive local authority digital services, must develop their own security policies and undertake regular audits to ensure they meet the requirements of this standard and maintain the integrity of their digital environment.

Controlling and managing access to the school network is essential for maintaining strong cyber security and protecting sensitive information and systems. Schools must have effective access control processes in place to ensure that users can access only the systems, services and data appropriate to their role, and that the risk of unauthorised access is minimised.

Access controls should include a combination of measures such as role based permissions, strong authentication practices, and appropriate restrictions on where and how users can connect to the network. This may include the use of additional authentication controls for higher risk access, segmented network access for learners, staff and guests, and restrictions designed to reduce exposure to external threats.

Administrative privileges present a higher level of risk and must be tightly controlled. Schools should ensure that only their education technology support partners or designated, trusted members of staff are granted administrative access to systems and network infrastructure. Restricting these privileges reduces the likelihood of unauthorised software installation and accidental or malicious changes to critical services.

User access and privilege arrangements must be actively maintained. Regular reviews of user accounts and access levels should be carried out to ensure permissions remain appropriate, that access is removed promptly when no longer required, and that any indicators of inappropriate use or access can be identified and addressed in a timely manner.

School networks underpin core operations and provide essential access to digital learning tools and services. As a result, they should be protected by a combination of robust security controls and effective monitoring arrangements to reduce risk, detect threats early and support a timely response.

Schools must ensure that appropriate network security measures are in place to defend against external threats such as hacking attempts, phishing and malware, as well as internal risks arising from compromised devices, unsafe removable media or accidental or malicious user actions. This includes the use of well configured firewalls to prevent unauthorised access, encryption to protect data in transit and at rest, and identity protection measures such as multi factor authentication where appropriate.

Effective network monitoring is essential for identifying suspicious or abnormal activity at an early stage and enabling a timely response to minimise disruption, protect sensitive data and maintain network integrity. Monitoring should support the detection of malware, hacking attempts, phishing activity and risks arising from infected devices, unsafe removable media or accidental or malicious user actions.

Network monitoring also plays an important role in managing and overseeing online access by learners and staff, supporting safeguarding obligations and helping ensure that filtering and access controls remain appropriate and effective.

Schools should work with their local authority or education technology support partner to review current security and monitoring arrangements and confirm that suitable alerting and reporting mechanisms are in place. Schools that manage their own education technology must ensure clear monitoring and response arrangements exist so that risks are identified, escalated and addressed promptly.

Schools operate a wide range of network‑connected devices, including tablets, laptops and desktop computers smart classroom devices and other school owned hardware that access or interact with the school network. To safeguard these devices and the data they process, appropriate cyber defences must be applied consistently across the managed device estate.

All school-owned devices must be enrolled in approved device management arrangements and maintained in line with the Device Management standard. Centralised management enables security policies, updates and protective controls to be applied consistently, reducing the risk that vulnerabilities on individual devices could compromise the wider network.

Cyber threats such as malware, viruses, spyware and other malicious software can disrupt learning and teaching, compromise sensitive data and lead to breaches of data protection and safeguarding obligations. To mitigate these risks, schools must ensure that device protections are robust, comprehensive and kept up to date. This includes maintaining current anti‑malware solutions and ensuring that protective measures are applied consistently across all school‑owned user devices.

A well structured incident response plan ensures that schools can act quickly and effectively when faced with a network or data security incident. The strategy should set out clear steps for identifying an incident, containing it, mitigating the risks and minimising disruption to teaching, learning and essential operations. It should support a coordinated response that allows the school to regain normal service as safely and efficiently as possible.

All incident response protocols should be fully documented, kept up to date and stored in a location accessible to the staff who may need them. They should be reviewed regularly, particularly after any significant change, security alert or real incident, to ensure they remain accurate and effective. The plan must also be clearly communicated so that relevant staff understand their responsibilities, the escalation routes and who to contact in the event of an incident.

Schools, with support from their local authority support, should ensure their arrangements align with and integrate into the authority’s wider incident response strategy. This includes understanding how incidents are reported, how decisions are escalated and how technical support will be coordinated. Independently managed schools should develop a school specific plan that is equally robust and tailored to their context. This should include agreed ways of working with their education technology support partners so that roles, communication channels and response expectations are clearly defined.

Regularly updating software and operating systems is essential to maintaining the security and stability of school devices. Developers release updates to address newly identified vulnerabilities, and failing to apply these patches leaves systems exposed to potential cyber‑attacks. In addition to strengthening security, updates often improve device performance, stability and compatibility with other applications and services.

Schools that use mobile device management (MDM) tools or delivery optimisation solutions can schedule updates to occur outside school hours, reducing pressure on the network during teaching time and avoiding unnecessary disruption in classrooms. For schools without MDM in place, it is important that clear, well‑defined manual update procedures are established and followed consistently. This ensures that all devices remain secure, supported and aligned with the school’s wider digital and safeguarding responsibilities.

Effective management of school‑owned mobile devices is essential for protecting data and maintaining the security of the school’s network.

Schools should ensure that all mobile devices are enrolled and managed in a device management solution to enforce security settings, apply updates, provide device monitoring and support remote admin access. These measures help safeguard both the device itself and any sensitive information it may hold.

Schools should also establish clear and well‑communicated mobile working policies to ensure staff understand how to use school devices securely when working off‑site. These policies should address areas such as device encryption, the use of secure Wi‑Fi connections, identity protection including the use of multifactor authentication and the availability of remote wipe capabilities so that data can be protected in the event of a device being lost or stolen.

Removable media can introduce significant security risks to a school’s network, including the spread of malware and the potential for data breaches if devices are lost, stolen or used inappropriately. As a result, schools should seek to minimise the use of removable media wherever possible and ensure that its use is clearly controlled, justified and well managed.

Schools should establish clear, well communicated guidelines governing when and how USB drives and other portable storage devices may be used. These guidelines should ensure that sensitive data stored on removable media is encrypted, that usage is restricted through appropriate access controls, and that unapproved devices cannot be connected to school systems. Where safer alternatives exist, such as managed cloud based storage or approved offline working arrangements, these should be used in preference to removable media.

Schools should regularly review their policies and practices to ensure they align with wider security policies and technical standards set by their local authority. Expectations for staff and learners should be clear and consistently applied. A proportionate and consistent approach to managing removable media helps protect data, strengthens cyber security and reduces the likelihood of accidental or unauthorised data exposure.

Cyber security is a shared responsibility across the school community. All staff must understand their role in maintaining the security of data and digital systems, including following best practices for password management, using devices responsibly and adhering to the school’s policies and procedures. Everyday behaviours, such as recognising phishing attempts, reporting suspicious activity and ensuring sensitive information is handled appropriately, contribute significantly to the school’s overall security posture.

Senior leaders play a central role in setting expectations and establishing a culture where cyber security is taken seriously. They are responsible for implementing appropriate policies, ensuring compliance and providing the necessary support and resources for secure digital practice. It is also the responsibility of leaders to ensure that education technology support partners meet agreed standards and operate in accordance with the school’s policies and regulatory requirements.

Regular and well targeted staff training is essential to keep everyone informed, confident and prepared to respond to emerging threats. This may include participation in supported awareness activities such as simulated phishing exercises, which help staff recognise risks in a realistic and practical way. By ensuring that all members of the school community understand their responsibilities, schools can strengthen their defences, reduce risk and foster a culture of vigilance and accountability.