Meeting the DfE’s Core Digital Standards for 2030
Everything from Abid Patel’s session in one place: the six core standards, what good cyber security looks like, quick wins for this term, and the free support behind each one.
Why this matters
Schools run on digital
Teaching, communication, safeguarding, operations and leadership all depend on reliable technology and secure data. An outage or a compromised account is never just an IT problem. When technology simply works, teachers can teach and leaders can lead, instead of firefighting.
The reality
16%
of schools reported meeting the standards when the DfE consulted in March 2025.
Sources: DfE consultation (opens in a new tab) · Schools Week (opens in a new tab)
Ageing systems
Servers, switches and laptops that are out of support and no longer getting security updates.
Inconsistent processes
Key tasks that only work because one person knows how, with nothing written down.
Growing cyber threats
Phishing that gets more convincing every month, and ransomware that can take a school offline in seconds.
None of this is about schools not caring. It is about time, budget and clarity, and that is exactly why a clear target for 2030 helps.
The standards
Six core standards by 2030
The DfE expects every school and college to meet these six by 2030. Each card opens the DfE’s own guidance for that standard.
Broadband internet
The right connection and speed for your school, plus a backup line so a single failure does not take you offline.
Read the DfE Standard (opens in a new tab)Wireless network
Coverage, performance and security across the whole site, not just the staffroom.
Read the DfE Standard (opens in a new tab)Network switching
Reliable, secure and resilient switches: the often forgotten boxes in the cupboard that everything runs through.
Read the DfE Standard (opens in a new tab)Digital leadership and governance
A named senior leader responsible for digital, a strategy reviewed every year, and up-to-date registers of what you own.
Read the DfE Standard (opens in a new tab)Filtering and monitoring
A safe online environment for pupils and staff, in line with Keeping children safe in education.
Read the DfE Standard (opens in a new tab)Cyber security
Protect your systems, your data and your user accounts, across the seven areas set out further down this page.
Read the DfE Standard (opens in a new tab)These six sit within the DfE’s wider set of digital and technology standards. The DfE has said it will explore greater accountability on them, so this is the direction of travel.
See All the DfE Standards (opens in a new tab)A roadmap, not a hurdle
It is easy to read the standards as technical hurdles to hand to IT. They are better read as a roadmap with three payoffs.
Safeguarding
Keeping children safe in education already expects appropriate filtering, monitoring and cyber security. The standards are how you evidence what you already have to do.
Read KCSIE (opens in a new tab)In practice
Clear evidence for governors and inspectors that pupils and data are kept safe.
Efficiency
Good foundations mean fewer outages, less firefighting and better value from every pound you spend on technology.
In practice
Fewer support calls, predictable spending and less teaching time lost to outages.
School improvement
When staff trust the technology, they use it with confidence, and learning benefits.
In practice
Digital priorities in the development plan, each with an owner and a budget.
Cyber security: core standard
What good looks like
The cyber security standard covers seven areas. Here is the expectation in each, with a link to that part of the DfE standard and to free help where it exists.
Risk assessment
Carry out a cyber risk assessment every year, and review it every term.
Cyber awareness
Everyone with a login signs the acceptable use policy. Every member of staff trains at least once a year, including at least one governor or trustee.
Anti-malware and firewall
Centrally managed, actively monitored and kept up to date.
User accounts
Multi-factor authentication on every staff account that uses cloud services and on every admin account. People only get the access they need.
Licensing and updates
High and critical security updates applied within 14 days of release.
Backups
Three copies on two different devices, one of them off-site. Immutable, so ransomware cannot change them, and test restored every term.
Reporting
Report an attack to Report Fraud and to the DfE, and tell the ICO within 72 hours if there is a high-risk personal data breach.
From the field
The three gaps we see most often
- Multi-factor authentication missing on some staff accounts
- A backup that has never been test restored
- No written cyber response plan
Risk Protection Arrangement
In the RPA? Four conditions for cyber cover
- Offline backups
- NCSC cyber security training
- Registering with Police CyberAlarm
- A cyber response plan
People and culture
Cyber Security is Safeguarding
Keeping pupils safe now means keeping their data, accounts and devices safe too. Technology alone will not get you there: culture is what makes it stick, and it comes down to four simple behaviours.
“Well-informed users are the best line of defence against cyber criminals.”
Spot it
Recognise phishing, odd requests and links that feel urgent or out of character.
Report it
Tell IT straight away, with no blame. A report in two minutes is a win. A report two days later, from someone too worried to speak up, is a disaster.
Follow it
Follow the acceptable use policy and device policies, and lock your screen when you step away.
Own it
Everyone with a login plays a part, from pupils to governors.
Who owns what
The standards are clear that digital is a senior leadership responsibility, not just an IT one.
- SLT digital lead
- Accountable for strategy, priorities and coordination
- IT support
- Carries out the technical work, in-house or outsourced
- Headteacher
- Makes the decisions and owns cyber awareness
- Governors and trustees
- Oversee strategic risk, with at least one trained
- DPO and DSL
- Build data protection and safeguarding into every decision
- Business and finance
- Manage budgets, contracts and registers
Outsourced IT?
If your provider is not meeting the standards, the DfE says you should review that no later than your next renewal. Ask them directly how they meet each one.
Free help for staff and governors
Start on Monday
Quick wins for this term
Most of them are free. If you only do one thing after today, pick one of these and do it before Christmas.
Turn on MFA
Switch it on for every staff cloud account and every admin account, so a stolen password is not enough on its own. It is the single biggest risk reducer.
DfE Guidance on MFA (opens in a new tab) 02Test a restore
Restore a real file from backup and log the result. A backup you have never restored is a hope, not a plan.
NCSC on Backups (opens in a new tab) 03Train everyone
Use the free NCSC training for all staff and at least one governor. RPA members need it for cyber cover.
Free NCSC Training (opens in a new tab) 04Fix leavers
Agree a joiners, movers and leavers process with HR, so old accounts are closed on the day someone leaves.
DfE on User Accounts (opens in a new tab) 05Check email security
Run your domain through the NCSC’s free email security check to find gaps that let others send email pretending to be you.
NCSC Email Security Check (opens in a new tab) 06Self-assess
Complete Plan technology for your school to see where you stand against the six standards.
Plan Technology for Your School (opens in a new tab)Making it achievable
Four steps to 2030
Quick wins build momentum, but the goal is a strategy that lasts.
Review
Audit your infrastructure, policies and practice against the six standards.
Prioritise
Invest by risk, not by who shouts loudest: safety first, then resilience, then refresh.
Start with
A simple, costed risk register
Strengthen
Build staff awareness and confidence, not just better systems.
Embed
Make the termly checks routine: risk, user accounts, firewall rules and backup tests.
Start with
Termly reviews in the school calendar
Building a lasting strategy
This term
Get the basics in place and build momentum
- Name an SLT digital lead
- Self-assess against the six standards
- Land the quick wins
This year
Turn quick wins into a written, funded plan
- Put digital strategy in the development plan
- Keep asset and contracts registers current
- Test a cyber response plan
By 2030
Meet all six core standards and keep meeting them
- All six standards met
- A refresh cycle in the budget
- Reviewed with governors every year
You are not on your own
Free support to use now
A lot of what you need is already free.
From the DfE
From the NCSC
Safer, more resilient, more future ready schools
Want a hand meeting the standards?
ITjustworks supports schools and trusts across the country with cyber security, digital strategy and transformation. No obligation and no jargon, just an honest conversation about where you stand.