iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
School governors and trustees should seek regular evidence that leaders understand the school’s cyber risks, protect essential services and can recover from an incident. They oversee risk and preparedness; school leaders and competent IT support are responsible for technical decisions and implementation.
This is a practical board-level adaptation of official guidance, not an official National Cyber Security Centre (NCSC) checklist. The NCSC and Department for Education (DfE) say their governor questions are “not intended as a checklist.” Use the prompts below to structure discussion alongside the current DfE cyber security core standard.
Who is responsible for cyber security in a school?
Governors and trustees provide strategic oversight and scrutinise risk management. Senior leaders set direction, make decisions and ensure responsibilities are clear; the person or team coordinating IT, together with competent internal or external support, handles technical implementation. Accountability should not become blurred just because IT is outsourced.
Ask leaders to explain the school’s arrangements and provide evidence that responsibilities and escalation routes are understood:
#1 Best Overall
- Who is the senior leader accountable for digital technology and cyber risk?
- Who coordinates IT day to day?
- Which local authority, trust, managed service, cloud, connectivity and software providers support the school, and what are their responsibilities?
- How does cyber risk appear in the risk register, and how often does the governing body review it?
- Who makes decisions and who is contacted if a suspected incident occurs?
The DfE’s maintained schools governance guide says at least one governor should complete cyber security training. Governors can use training to ask informed questions without taking on the technical work themselves.
What services and information matter most?
Leaders should identify the school’s own critical services and sensitive information rather than rely on a generic list. Consider what would cause the greatest harm or disruption if a system became unavailable, or if information were exposed.
- Which systems support teaching, safeguarding, administration, payroll, communications and site operations?
- Which records are especially sensitive, and who needs access to them?
- What dependencies on suppliers, connectivity or other systems could interrupt an essential service?
- Which unresolved risks or supplier issues require board attention?
A management information system may be critical because it can hold medical, safeguarding and parent contact information. The consequences of compromise or outage depend on the school’s particular systems and operations.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
How can governors check whether the school meets the DfE cyber security standard?
Ask leaders to map the school’s arrangements to the full, current DfE cyber security core standard, identify gaps and assign owners and actions. The standard calls for a cyber risk assessment at least annually and review of that assessment each term. Ask to see when each was last completed, what changed, and how overdue actions are being managed.
The DfE’s Cyber Security Hub checklist, last reviewed 16 July 2026, is a useful companion for tracking actions such as multi-factor authentication, backups, response planning, awareness and clear responsibilities. It does not replace the detailed standard. The DfE says schools and colleges should be working towards its cyber security expectations by 2030. Its governance guidance also identifies six core digital and technology standards to work towards by 2030: filtering and monitoring, cyber security, broadband internet, network switching, wireless network, and digital leadership and governance.
Are accounts, devices and people adequately protected?
Ask leaders for evidence that the controls in the DfE standard are in place and being maintained. A policy alone is not evidence that a control works.
- Accounts and access: Are accounts approved and limited to appropriate access? Are access rights reviewed, and are accounts removed promptly when staff leave or change roles?
- Multi-factor authentication: Is it used where appropriate, especially for important accounts, as highlighted in the DfE Cyber Security Hub checklist?
- Devices and systems: Are technology assets supported, licensed, protected and updated on time? Who tracks issues that cannot be updated or supported?
- Staff awareness and reporting: Is there a cyber awareness plan and relevant training? Do staff and pupils know how to report suspicious messages or suspected incidents, and is there a clear route for doing so?
- Governor understanding: Has at least one governor completed cyber security training, as recommended in DfE governance guidance?
These are layers of risk reduction, not guarantees that an incident cannot happen. Ask leaders how they check that controls are applied and what happens when a gap is found.
Can the school restore data and keep operating?
Backups matter only if the school can restore the information and systems it needs. The NCSC governor guidance recommends a backup and restoration plan and practising restoration; the DfE standard also calls for incident response and business continuity arrangements.
- What systems and data are backed up, how often, and who checks that the process completes?
- How are backups separated from the systems they protect, in a way suited to the school’s systems and risks?
- When was restoration last tested, what was restored, and were any problems fixed?
- Is the incident response plan connected to business continuity and disaster recovery arrangements?
- How will essential teaching, safeguarding, communications and administration continue if key systems are unavailable?
Ask for evidence of a restoration exercise and resulting actions, not simply confirmation that backups exist. The reviewed official guidance does not prescribe one backup device, architecture or vendor; technical choices should fit the school’s assessed risks and be made with competent IT advice.
Rank #4
What should a school do after a cyber attack?
Governors should know how leaders will coordinate the response and preserve essential operations, rather than direct technical containment themselves. The school’s response plan should specify who takes charge, who contacts support organisations, how leaders inform governors and how the school will meet relevant reporting obligations.
Ask leaders to walk through a realistic scenario, such as loss of access to a critical system or suspected exposure of sensitive records:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Who receives the initial report, and how is it escalated to the senior leader responsible?
- Who contacts the school’s IT support, service providers and other organisations needed to investigate and respond?
- How and when will governors be informed, and who is authorised to make urgent decisions?
- How will the school maintain essential functions while systems are unavailable?
- Who assesses whether external reporting is required, and how are response and recovery actions recorded?
- After recovery, how will leaders review what happened and address identified weaknesses?
The exact contacts and actions depend on the incident and the school’s arrangements. Governors should seek assurance that leaders have established a workable plan, know where to find it and have practised relevant parts.
Best Value
- Great extension activities for science and biology
- Correlated to standards
- Comprehensive biology vocabulary study
- Fascinating true-to-life illustrations
How should governors use the checklist?
Use these questions as a structured conversation, not as a substitute for the DfE standard or an audit. The NCSC and DfE governor questions were published and reviewed on 15 July 2020; they remain a discussion aid, but should be read alongside the current DfE requirements.
For each area, request concise evidence, an accountable owner and any next action. If an answer is unclear or a risk remains unresolved, record who will follow up and when the governing body will revisit it. Technical implementation should remain with school leaders and competent IT support.
Official references: NCSC, Cyber security in schools: questions for governors and trustees; DfE, Cyber security core standard; DfE Cyber Security Hub; and DfE maintained schools governance guide.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
