Schools hold sensitive data about children, depend on a handful of cloud services to open each morning, and usually have one IT technician or an outsourced provider to protect it all. A cyber incident in a school is also a safeguarding incident: lost records can include child protection files, special educational needs data and medical information, and an outage can stop registers, payments and exams. This guide covers the threats schools face, the standards and laws that apply in England and the US (DfE cyber security and filtering standards, the Risk Protection Arrangement, UK GDPR, FERPA, COPPA and CISA's K-12 recommendations), the priority controls, and how to roll them out with limited staff. It is written for school and trust IT leads, school business managers, designated safeguarding leads, governors, US district technology directors and the managed service providers that support them.
Key takeaways
- Attacks are common, and they start with email. In the UK Cyber Security Breaches Survey 2025, 60% of secondary and 44% of primary schools identified a breach or attack in the previous 12 months, and phishing was involved in 89% of those cases.
- England has a concrete baseline. The DfE cyber security standards set measurable expectations, such as MFA for staff with cloud or remote access, high-risk patches within 14 days and three backup copies with one offsite and immutable.
- Insurance depends on it. Risk Protection Arrangement (RPA) members must have a cyber response plan, meet the backup standard and evidence annual NCSC staff training as conditions of cyber cover.
- Safeguarding and security share systems. Filtering and monitoring are safeguarding duties under Keeping Children Safe in Education, owned jointly by leadership, the DSL and IT, and they depend on the same network and identity controls.
- Five controls first. CISA's K-12 report and the DfE standards agree: MFA, patching known exploited vulnerabilities, tested backups, an exercised incident response plan, and staff training.
Why schools are different
- Children's data: safeguarding records, SEND plans, free school meal eligibility, medical and family information sit in the management information system (MIS) and safeguarding platforms. The harm from exposure is higher than for most adult data.
- Thin resources: many schools have no security specialist. Security work competes with fixing projectors and onboarding new staff, and much of it is delivered by an MSP, a trust central team or a local authority.
- Shared and young users: pupils share devices and classroom accounts, young children cannot manage passwords, and pupils are often more technically curious than staff expect.
- Cloud dependence: MIS, email, learning platforms, payments, catering and visitor systems are mostly SaaS. A supplier outage or breach can stop a school as completely as ransomware.
- Calendar pressure: exam seasons, admissions and the start of the school year are when downtime is least tolerable and phishing lures are most convincing.
Threat picture
| Measure (CSBS 2025, fieldwork Aug to Dec 2024) | Primary schools | Secondary schools | Businesses overall |
|---|
| Identified a breach or attack in last 12 months | 44% | 60% | 43% |
| Phishing among those that identified one | 89% | 89% | 85% |
| Two-factor authentication on any networks or applications | 78% | 80% | 40% |
| Formal incident response plan | 71% | 74% | 23% |
| Threat | How it shows up in schools | ATT&CK technique | Priority control |
|---|
| Phishing and staff account takeover | Fake shared documents, parent or supplier emails, payroll lures; compromised staff mailboxes used to phish parents and other schools | T1566 Phishing; T1078 Valid Accounts | MFA for all staff, anti-spoofing email, training |
| Ransomware and data extortion | Encryption of on-premises servers and MIS backups, theft of safeguarding and HR files, threats to publish pupil data | T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1486 Data Encrypted for Impact | Patching, MFA on remote access, immutable offsite backups |
| Supplier and EdTech breach | MIS, learning platform or communications app breached at the vendor, exposing many schools at once | T1078 Valid Accounts | Supplier due diligence, data minimisation, contract terms |
| Payment and invoice fraud | Altered supplier bank details, fake trip or meal payment requests to parents | T1566 Phishing | Out-of-band verification of bank changes, DMARC |
| Insider and pupil misuse | Pupils obtaining staff passwords, accessing grades or bypassing filtering with VPNs or proxies | T1078 Valid Accounts | Separate admin accounts, lockout, filtering that blocks bypass tools |
| Denial of service | Pupil-launched DDoS against the school network during exams or tests | T1498 Network Denial of Service | Provider-level DDoS protection, monitoring |
Regulation and standards (status checked October 2026)
| Standard or law | Applies to | What it requires in practice |
|---|
| DfE cyber security standards for schools and colleges | Schools and colleges in England (expectations, not statute) | Annual risk assessment reviewed termly; awareness plan; firewall and anti-malware; account control and MFA; licensing and patching; backups; incident reporting |
| DfE filtering and monitoring standards (referenced in KCSIE) | Schools and colleges in England | Named roles, annual review, blocking harmful content without unreasonably affecting teaching, monitoring that meets safeguarding needs |
| Risk Protection Arrangement (RPA) cyber cover | Academies and maintained schools that are RPA members | Conditions include a cyber response plan, the three-copy backup standard and annual NCSC training evidence |
| UK GDPR and Data Protection Act 2018 | All UK schools | Security of processing; report high-risk personal data breaches to the ICO within 72 hours; DPIAs for high-risk processing such as monitoring |
| FERPA (20 U.S.C. 1232g; 34 CFR Part 99) | US schools receiving Department of Education funds | Parents' rights over education records and controls on disclosure |
| COPPA Rule (16 CFR Part 312), amended 2025 | Online services collecting data from children under 13, including EdTech used in schools | Separate parental consent for third-party disclosure for advertising, retention limited to what is reasonably necessary, biometric identifiers now personal information |
| CISA K-12 recommendations (K-12 Cybersecurity Act of 2021) | US K-12 districts (guidance) | High-impact controls first, then CISA Cybersecurity Performance Goals, then a NIST CSF-based plan |
- COPPA timing: the FTC finalised the amendments in January 2025; they took effect 60 days after Federal Register publication, with one year from publication for full compliance, which places the compliance date in April 2026. Ask EdTech suppliers how they meet the new consent and retention rules.
- US funding: CISA points districts to the State and Local Cybersecurity Grant Program, and the FCC created a three-year Schools and Libraries Cybersecurity Pilot Program of up to $200 million covering firewalls, endpoint protection, identity protection and authentication, and monitoring, detection and response. Check USAC for its current status before planning around it.
- Further reading: see the FERPA Guide for Security Teams and the UK GDPR and Data Protection Act 2018 Guide.
The DfE cyber security standards in detail
The standards are the most specific public baseline for schools anywhere, and they are useful outside England as a checklist.
| Standard | Measurable expectations |
|---|
| 1. Cyber risk assessment | Annual, reviewed every term and after major change or an incident; risk register, cyber response plan and business continuity plan kept in at least one other location (cloud or paper) |
| 2. Cyber awareness plan | Training at least annually for staff, pupils, at least one governor or trustee and anyone with a login; acceptable use policy covering guests and supply staff |
| 3. Anti-malware and firewall | Firewall firmware and inbound rules reviewed termly and signed off by the SLT digital lead; inbound unauthenticated connections blocked by default; centrally managed anti-malware; USB blocked by default; email configured to prevent spoofing |
| 4. User accounts and access | MFA for all staff with cloud or remote access and for all IT admin accounts; lockout after 10 failed attempts (or 10 guesses in 5 minutes); accounts disabled promptly on leaving; termly review; separate admin accounts with SLT or trustee approval for changes |
| 5. Licensing and updates | Critical and high fixes (CVSS 7.0 or above, or unrated) within 14 days; DfE-notified updates within 5 working days; unpatchable devices isolated; asset registers reviewed termly |
| 6. Backups | At least 3 copies on 2 separate devices with 1 offsite; immutable; encrypted if physical; never taken home; tested and logged termly; plan reviewed annually |
| 7. Reporting | Immediate internal reporting; report to the RPA or insurer, Report Fraud and the DfE sector cyber team; ICO within 72 hours for high-risk breaches; NCSC for serious incidents; further education to Jisc |
US districts can use the same structure and map it to the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) Guide. Schools also seeking certification can align with the Cyber Essentials Guide.
Filtering, monitoring and safeguarding
- Roles: the governing body names a responsible SLT member and governor; the SLT buys and governs the systems and documents block and allow decisions; the DSL leads on safeguarding and responds to alerts; IT support maintains the systems and provides reports.
- Coverage: filtering applies to school-managed devices including off site, to BYOD on a separate network and to guests. Separate pupil and staff profiles at minimum.
- Bypass: block VPNs, proxies and encryption methods used to evade filtering, and enable safe search by default. This is also a security control: the same tools are used to hide malware traffic.
- Lists that cannot be overridden: the Internet Watch Foundation and Counter-Terrorism Internet Referral Unit lists must not be disabled by any user or administrator.
- Testing and reporting: check filtering regularly (the SWGfL test site helps) and log each check; monitoring provides weekly incident reports and immediate alerts for high-risk events.
- Data protection: monitoring pupils' activity is high-risk processing. Complete a DPIA and tell users monitoring is in place. See the DPIA Guide and the Secure Web Gateway and Web Filtering Guide.
Where identity fits
- Staff first: MFA for every staff member using cloud email, MIS and remote access, and phishing-resistant methods (security keys or passkeys) for IT administrators and finance staff. Passkeys work well for staff with dedicated devices, as the DfE standard notes.
- Separate admin accounts: technicians and MSP engineers use named admin accounts, not shared logins, and not their day-to-day mailbox account. Remove MSP access when a contract ends. See the Third-Party Access Guide.
- Pupil accounts: age-appropriate sign-in for young children (QR badges or picture passwords on managed devices), unique accounts as soon as pupils can manage them, and automatic creation and removal driven from the MIS. See the Education Identity Security Guide.
- Integration accounts: MIS connectors to the learning platform, parent apps and payment systems often read the whole pupil database. Know which exist, who approved them and what data they pull.
Implementation: a phased plan for a school or trust
- Term 1 (start here): MFA for all staff and admin accounts, piloted with the SLT and office staff for two weeks before everyone, with a documented process to reset a locked-out teacher on the same day; separate admin accounts; confirm three backup copies with one offsite and immutable, and test one restore of the MIS; write a one-page cyber response plan with phone numbers kept on paper.
- Term 2: patch process with the 14-day target and an asset register; anti-spoofing email (SPF, DKIM and DMARC moving to enforcement, see the DMARC, SPF and DKIM Guide); NCSC staff training for all staff and a governor; joiner and leaver process tied to HR.
- Term 3: filtering and monitoring review with SLT, DSL, IT and the governor; supplier review for EdTech holding pupil data, using the Vendor Security Assessment Template; a short tabletop exercise on a ransomware attack on the first day of exams.
- Every year: refresh the risk assessment, retrain, re-test backups and filtering, review admin and MSP accounts, and report to governors.
Roll back any control that blocks teaching by narrowing scope, not by switching it off: exclude a specific device group or timetable exception, log the exception with an end date, and review it at the next termly review.
Decision guidance: single school, trust or district
| Decision | Single school | Multi-academy trust or US district |
|---|
| Who runs security | MSP or local authority service, with an SLT digital lead accountable | Central trust or district team setting one baseline for all schools |
| Identity platform | Use the education tenant's built-in MFA and conditional access | One tenant or federation per trust, central admin accounts, delegated school roles |
| Devices | Cloud-managed laptops or Chromebooks, no local admin for staff | Central device management and EDR across all schools (see the ChromeOS and Chromebook Security Guide) |
| Detection | Provider alerts plus free national services such as NCSC Protective DNS and Web Check | Shared SOC or managed detection, information sharing through MS-ISAC (US) or sector groups |
Detection and measurement
- Watch first: sign-ins to staff accounts from unusual countries, new mailbox forwarding rules, MFA method changes after a reset, bulk exports from the MIS, and filtering alerts for bypass tools.
- Free services: in the UK, the NCSC offers free staff training, Web Check for public-facing systems, Protective DNS for schools and Exercise in a Box for rehearsing incidents.
| Metric | Target |
|---|
| Staff and admin accounts with MFA enforced | 100% |
| Critical and high patches applied within 14 days | Above 95%, with exceptions isolated |
| Successful MIS and file server test restore this term | Yes, logged |
| Staff and governors completing annual training | 100% |
| Leaver accounts disabled within one working day | 100% |
| Filtering checks logged this term | At least one, with actions recorded |
Framework mapping
| Control area | DfE standard | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | CIS Controls v8.1 |
|---|
| Risk assessment | 1 | ID.RA-05 | RA-3 | No single control (basis for IG1 scoping) |
| Awareness and training | 2 | PR.AT-01 | AT-2 | 14 |
| MFA and accounts | 4 | PR.AA-03 | IA-2, AC-2 | 5, 6 |
| Patching | 5 | ID.RA-01 | SI-2 | 7 |
| Backups | 6 | PR.DS-11 | CP-9 | 11 |
| Incident reporting and response | 7 | RS.MA-01 | IR-4 | 17 |
| Suppliers and EdTech | Contracts reviewed termly (5) | GV.SC-05 | SA-9 | 15 |
Common failure patterns
- Backups on the same network with the same credentials: ransomware encrypts the server and its backup share together. Immutable or offline copies are the fix.
- Shared admin passwords with the MSP: one generic login known by several engineers, never changed when staff or providers change.
- MFA for teachers but not for the office: finance and admissions staff hold the most valuable data and are the most targeted.
- Filtering treated as purely an IT setting: no DSL involvement, no logged checks, and pupils using VPN apps to bypass it.
- Unvetted free EdTech apps: teachers sign up classes to tools that collect pupil data with no DPIA, contract or deletion plan.
- Response plan stored only on the encrypted server: keep a paper or separate cloud copy, as the DfE standard requires.
Lessons from incidents
The Canvas Instructure breach in 2026 affected schools as well as universities: according to the incident analysis, a malicious support ticket gave the attackers a privileged token that was used to pull usernames, email addresses, enrolment data and messages, and Instructure's FAQ referred to around 8,800 institutions. Schools could not have prevented the vendor's flaw, but they control three things that limit harm: how much pupil data they put into each platform, whether contracts require prompt notification and short-lived tokens, and whether parents and staff are warned quickly about phishing that uses the stolen details.
Practitioner checklist
- Enforce MFA for all staff with cloud or remote access and all admin accounts, with separate admin accounts for technicians and MSP engineers.
- Keep at least three backup copies on two devices with one offsite and immutable, and test a restore every term.
- Apply critical and high patches within 14 days and isolate devices that cannot be patched.
- Write a cyber response plan, keep a copy off the network, and exercise it once a year.
- Train all staff, pupils and at least one governor every year, using the free NCSC package where it fits.
- Configure SPF, DKIM and DMARC and verify any bank detail change by phone.
- Review filtering and monitoring annually with SLT, DSL, IT and the responsible governor, and log checks.
- Inventory EdTech and integrations holding pupil data, with a DPIA and contract for each.
- Know your reporting routes: insurer or RPA, Report Fraud, DfE sector cyber team, ICO within 72 hours, NCSC; or CISA and MS-ISAC in the US.
Standards and references
Related NHI Mgmt Group resources: Education Identity Security Guide · Cybersecurity for Higher Education Guide · Cyber Essentials Guide · Ransomware Prevention Guide · Security Awareness and Human Risk Management Guide. This guide summarises regulatory obligations for security practitioners and is not legal advice.