DfE Cyber Security Standards Support

DfE Requirement – Review assets

The SLT digital lead and your IT support will:

•    review digital technology assets and any related cyber security risk 
•    check all digital technology is licenced, supported and updated – read the DfE standard on ‘Licence digital technology and keep it up to date’ 

How BSICT Helps

Bolton SICT includes industry standard enterprise grade Firewall, Web Filtering and Monitoring, Switching and WiFi, and MDM for iPad management as part of the services we provide. These solutions work together to give schools comprehensive visibility into their IT assets and ensure strong, layered security across networks and devices.

In addition, BSICT supplies a range of software licences tailored for educational settings. This ensures that all systems remain supported, secure, and up to date with the latest patches and features.

DfE Requirement – Check data processing, access and permissions

The SLT digital lead will work with the DPO to:

•    complete a record of processing activities (ROPA) for all new and current systems storing or processing personal and sensitive personal data – you can use a template ROPA from the Information Commissioner’s Office (ICO) 
•    assess staff access and permissions to systems and data, and check password policies
•    check that your email is set up to be secure and that it reduces the risk of third parties being able to send imitation emails

How BSICT Helps

At BSICT we have various systems that your users can access. When you’re reviewing the permissions that your staff have don’t forget to check the services that are available from us. If you need help accessing any of them please feel free to contact us via our support site.

DfE Requirement – Understand your network

The SLT digital lead will oversee this work, but IT support will:

•    keep documentation on your network up to date – this should include network diagrams, changes that are made, settings and IP addressing information 
•    discuss the level of logging required for your school or college’s network and systems which can help to identify the source of any cyber incident or attack and any network issues – to learn more about network logging, visit the National Cyber Security Centre (NCSC) guidance on logging and protective monitoring

How Bolton SICT Helps

Having logs when things go wrong can be really beneficial. Knowing what to look for in logs can be confusing though. This is why, alongside the NCSC guidance on logging, we would recommend looking into Police Cyber Alarm. This can be set up to collect logs from your school’s firewall, which are then sent to the police for them to review and highlight any suspicious activity to you.

DfE Requirement – Understand the current

The SLT digital lead will be responsible for collecting the relevant information from all those listed in the ‘Who needs to be involved’ section of this standard. Together they will:

•    identify any student or staff behaviour that may be seen as a risk and could expose the school or college to a cyber incident or attack – for example, downloading an application without the approval of IT support or clicking on links in emails.
•    understand what the greatest cyber risks are and establish the likelihood of these happening, along with the impact they may have on your school or college 
•    capture how many cyber incidents or attacks have already occurred and what they are so that you can understand common themes and know where you need to improve – you can test your cyber resilience using NCSC’s online tool 

How Bolton SICT Helps

Once you’re aware of the current risks to your school we would recommend managing them via a risk register, if you don’t already have one available as part of our Elevate Cybersecurity Toolkit. This also includes a reporting template that you can use to demonstrate to Governors how you’re managing cybersecurity risks.

DfE Requirement – Create a risk management process and cyber response plan

The SLT digital lead will work with the business professionals or the finance team, estate management and IT support to:

•    create a simple reporting structure for cyber risks to be captured, escalated and actioned – cyber risks should be captured in the risk register and placed into a regularly tested business continuity plan 
•    maintain documentation and your business continuity plan in at least one or more (diverse) locations – for example, in the cloud or as a hard copy 
•    flag any risks or issues identified to the governors or trustees as part of the school or college’s risk management process 
•    put a cyber response plan in place – as well as this being a part of your business continuity plan, it is also a condition of cover if you have risk protection arrangement (RPA) cover 

How Bolton SICT Helps

We have developed the Elevate Cybersecurity Toolkit, which has templates to help schools meet all of these requirements.

DfE Requirement – Create an acceptable use policy

An acceptable use policy describes what a person on the network can or cannot do when using digital technology.  

Anyone who has access to the school or college network or data will need to be made aware of, and sign up to, the acceptable use policy. This will include guests and supply teachers who want to use the school or college network and wifi.

The SLT digital lead will work with IT support, the designated safeguarding lead and the DPO to create and update the acceptable use policy.

If you use a student contract, then this should include relevant sections of the acceptable use policy to make it clear how digital technology should be used within your educational setting. This will need to be carried out at the beginning of every academic year.

You can find examples of acceptable use policies on the Education Data Hub website:

•    staff acceptable use policy
•    student acceptable use policy
•    visitor acceptable use policy

How Bolton SICT Helps

At Bolton SICT we have years of experience in developing ‘Acceptable Use Policies’ that are used in schools. Like the Education Data Hub website, we have templates that you can download and customise to your needs.

Staff, Governors & Volunteers
KS1 Pupils
KS2 Pupils
KS3 & KS4 Pupils
AUP in symbols for pupils with SEND
Visitors & Contractors
Parents

DfE Requirement – Train students and staff 

Training students and staff in cyber security is a vital step in maintaining safety and security. Cyber training should be given at least annually, or more regularly if there is a known cyber risk to those who use school or college digital technology.

The SLT digital lead will need to coordinate training with IT support, the DPO and the designated safeguarding lead. This training is for:

•   students 
•   staff 
•   at least one current governor or trustee 
•   anyone else with a login (for example supply teachers or agency workers) who may need more focussed training using your own resources – this should happen as soon as it’s feasible  

Training should be age-appropriate and suited to your school or college’s risks, but should generally include training on:

•   methods hackers use to trick people into disclosing personal information, including phishing 
•   password security 
•   online safety 
•   social engineering, including not using websites that host unsuitable material, and could also contain malware and viruses 
•   the physical security of devices, for example not leaving a laptop unlocked and unattended 
•   the risks of using removable storage media, such as USBs 
•   multi-factor authentication 
•   how to report a cyber incident or attack – read the standard on reporting a cyber risk within this standard topic
•   how to report a personal data breach 
•   data protection for all staff, with staff who are exposed to higher risk data having more frequent training, such as administrative staff, management or agency workers with a login 

If you have a risk protection arrangement, you must provide evidence that the relevant users have undertaken the free National Cyber Security Centre (NCSC) training. This needs to be taken annually.  

If you are looking for further support, the NCSC have downloadable copies of cyber security information cards for schools. 

How Bolton SICT Helps

At Bolton SICT we have a range of different training available to support schools:

•    We offer cyber security audits which we have populated with references to how BSICT’s services support cybersecurity for our schools.
•    We also deliver the NCSC Cyber Security Training for School Staff which we have completed with references to how BSICT’s services support cybersecurity for our schools.
•    LGfL have developed Cyber Security Training for School Governors which is available for free for any school governor.

DfE Requirement – Firewall

Many schools and colleges will be provided with a firewall as part of their broadband connection. If this applies to you, then you will need to discuss these technical requirements with your broadband provider.

To meet this standard, SICT support provides the following:

•    protect digital technology with a correctly configured boundary firewall.
•    keep boundary firewall firmware up to date, and on supported versions – this should be checked termly 
•    make sure all external connections to the network run through the firewall 
•    change the default administrator password and restrict remote access on the firewall to only those who need to access it for maintenance purposes  
•    protect access to the firewall’s administrative interface with multi-factor authentication, where available, and prevent access from the internet, except to those who need to maintain the firewall 
•    actively monitor firewall traffic and switch on firewall alerts to help detect suspicious activity – firewall logs can help you with both of these tasks 
•    block inbound unauthenticated connections by default 
•    document and review why inbound traffic has been permitted through the firewall – this should be done on a termly basis at a minimum.
•    keep firewall rules to an absolute minimum, with each rule being documented and subject to a risk assessment 
•    enable a software firewall for digital technology that is used outside of the school or college, such as at home or on public wifi 
•    consider a virtual private network (VPN) to encrypt data sent and received by a device 

How Bolton SICT Helps

•    Every BSICT site has a correctly configured industry standard enterprise grade Firewall.
•    The firewall firmware is reviewed and updated continuously to ensure it remains on a supported version, maintaining optimal security and performance, and any CVE’s (Common Vulnerabilities and Exposures) will be actioned asap.
•    Access to the firewall’s administrative interface is restricted to a small specified IP-allow list and a small number of administrators using MFA.
•    All external inbound and outbound connections pass through the firewall.
•    Default administrative passwords are replaced with complex credentials that align with industry best practices for security.
•    Our firewall are linked to a Cloud service providing protection by actively highlighting suspicious activity and threats in real time.
•    Block inbound and outbound unauthenticated connections by default.
•    Require all changes that enable inbound and outbound traffic to be submitted via a Request for Change that is logged in the service desk.
•     Windows devices on an SICT managed domain utilise Windows Defender firewall by default.
•    We use Citrix Remote Access, a secure-by-design platform that leverages encryption to safeguard all data transmissions between users and internal systems. VPN integration is also planned for future implementation to further enhance remote access security

DfE Requirement – Anti-malware software

Anti-malware software needs to be kept up to date with the latest updates. This should be reviewed termly to check that it is meeting your school or college’s needs. This software must:

•    scan web pages as they are being used  
•    have a centralised monitoring console to allow IT support to intervene should anti-malware software fail or not update 
•    scan files and applications upon access, when downloaded or opened locally or from a network folder 
•    scan attachments on incoming and outgoing emails for malware 
•    send malware alerts to IT support who will then investigate the issue – this could result in removing the malware or isolating the device 
•    prevent access to potentially malicious websites

The NCSC provide further guidance on how to select, configure and use anti-virus and other security software.

To help prevent malware from infecting digital technology from an external device, IT support should prohibit the use of USB storage devices by default, unless for a specific need – for example, if the examination board require this.

If USB storage devices are permitted in specific use cases, the anti-malware software should scan the USB drive before it is made available to the student or staff member.

How Bolton SICT Helps

BSICT includes industry standard enterprise grade Firewall for its customers which can be configured to meet all the requirements of this standard.

Although our industry standard enterprise grade Firewall can meet all of the requirements in this standard it is still important to check that it is setup and working as needed.

At a minimum, you should
•    Ensure that all devices in the school have a firewall installed and working
•    Check that the firewall recommended settings are configured
•    Check that alerts are set, and someone is monitoring them
•    Click here to find out more about Sophos best-practice settings

DfE Requirement – Security checks 

IT support should:

•    check downloads for malware before an individual can store or install them on their device – this should be in line with your school or college strategy
•    check and approve all current and future applications to make sure they do not pose a security risk 
•    maintain a current list of approved applications on your contracts register 
•    remove unnecessary software according to your organisational need 
•    only install applications that can be verified as coming from a known supplier 
•    document how digital technology is set up, which security features have been enabled or disabled, and whether they have conflicting security features 
•    review and manage browser settings to make sure the highest form of protection is enabled and that users are unable to change browser settings to install browser extensions or bypass security features 
•    check that your email is set up to be secure and that it reduces the risk of third parties being able to send imitation emails

The NCSC has a tool that can assist you with email security configuration and reporting.

How Bolton SICT Helps

The majority of this element of the standard is the responsibility of the school to achieve. BSICT can help in some areas though. Our industry standard firewall will automatically check every download for malware before it is run. We also have a Software Asset Register template within the Elevate Cybersecurity Toolkit for Schools that can be used to record approved applications. If your school uses email provided by BSICT you can also benefit from Microsoft Office 365 defender, to protect you from spoof emails. We can also help you configure appropriate anti-spoofing controls like SPF and DMARC.

DfE Requirement – Passwords

Users must be authenticated with unique credentials before they access devices or services. This can include using passwords.

IT support will need to:

•    enforce password strength at the system level – the NCSC suggest using machine-generated passwords or a three-random word system 
•    immediately change any passwords that have been compromised or are suspected of compromise 
•    protect all passwords – for example, by allowing no more than 10 guesses in 5 minutes, or locking devices after no more than 10 unsuccessful attempts

On networking devices and servers, IT support should:

•    use a password or PIN of at least 6 characters to physically access network switches and boot-up settings – the password or PIN must only be used to access this device 
•    agree on a process with the SLT for securing access to key system passwords and PINs in the event of an emergency, or if IT support is unavailable

For younger children, users with special educational needs or disabilities, or for those with English as an additional language, consider using:

•    other means of logging on, other than passwords – for example, using a PIN code 
•    a separate account accessed by the teacher using the student’s login so that the student can still be identified – this should follow the filtering and monitoring standards

Visit the NCSC website to learn more about setting up password policies.  

How Bolton SICT Helps

The majority of the elements in this standard relate to services that are managed by schools. 

BSICT helps by ensuring that all of its services are protected with appropriate password controls. All USO accounts benefit from automatic delays to protect them from brute force attacks and can be configured with multi-factor authentication.

DfE Requirement – Multi-factor authentication (MFA)

MFA secures your account by asking the user to provide 2 or more pieces of evidence to verify their identity. This could include a password and a login through another device.

MFA may not be accessible for those with special educational needs and disabilities. In these circumstances, you will need to discuss alternatives or extra support when logging in.

Senior leaders, and staff (including internal and external IT support staff) working with confidential, financial, and personal and sensitive personal data must use MFA.

If appropriate for your school or college, you may also wish to explore:

•    MFA for all cloud or online services  
•    MFA for all staff accounts 
•    MFA for students where the verification does not need to be completed on a mobile phone in keeping with the Department for Education’s (DfE) guidance on prohibiting the use of mobile phones for students throughout the school day

MFA should include at least 2 of the following:

•    a password 
•    a text message which will send a code to a mobile device, this is for staff only 
•    an automated phone call to a given phone number that reads out a code (as an alternative to a text message) 
•    a secure portable device, such as a mobile phone or tablet for staff 
•    a security key or device, used to authenticate logins – the school or college may need to pay for this if staff do not have access to a secure mobile phone 
•    a known or trusted account, where a second party authenticates another’s credentials 
•    a biometric test, for example, face identification – this may need careful consideration as it might require a biometric policy depending on how the data is stored

Where MFA is not available, a more complex password should be used following the recommended guidance around password security in this standard.

The NCSC has some further guidance on:

•    setting up 2-step verification 
•    MFA for online services

If staff access a number of systems, you should consider using a single sign-on solution, which allows you to sign on once and access all applications. 

How Bolton SICT Helps

All accounts used by Nominated Contacts (accounts with permission to make administrative changes or request system changes) are configured to use multi-factor authentication.

DfE Requirement – Account management

IT support needs to control user accounts and access privileges by:

•    disabling accounts as soon as someone leaves 
•    creating and managing a process with human resources and your business professionals or the finance team to deal with joiners, leavers, and those moving roles

IT support should consider using tools that link to the management information system (MIS) to automatically create or delete user accounts which will make this process easier to manage.

IT support will also:

•    make sure that accounts are set up so that students and staff only have access to the data and systems they need 
•    make sure that MFA is applied to any accounts and cloud-based applications for staff working away from the school or college, or remotely accessing the network  
•    make sure that remote access is disabled when not required, and enabled only by a member of authorised school or college staff 
•    make sure that enhanced security, such as MFA, is always used where staff are handling confidential, personal or sensitive personal data – your data protection officer can advise which systems and data need this 
•    review accounts with your business professionals or the finance team every term to identify changes that might have been missed – this should include changing access levels and rights, and suspending or deleting accounts which are no longer in use 
•    make sure that global or administrative accounts are not used for routine business and that instead, dedicated accounts (not used for day-to-day email and work) have enhanced privileges – this helps limit any damage and track issues in the event of an incident or attack 
•    agree a process for handling administrative accounts so that a member of SLT or a trustee approves any changes to access levels or privileges before IT support can action the change 
•    make sure SLT have access to a dedicated administrative account – this will only be needed in an emergency where IT support is unavailable

The NCSC has detailed guidance on privileged access management. 

How Bolton SICT Helps

At BSICT we have various systems that your users can access. When you’re reviewing the permissions that your staff have don’t forget to check the services that are available from us. If you need help accessing any of them please feel free to contact us via our support site.

DfE Requirement – Licencing

All software needs to be licenced and eligible for security updates. You should remove unlicenced software or take steps to licence it.

IT support will need to check that:

•    operating systems and firmware on digital technology are kept up to date 
•    updates are issued in a timely manner that does not impact on teaching and learning 
•    licence expiry dates are recorded in the contracts register by the business professionals or the finance team, and that any unlicenced software is removed from devices 
•    your business professionals or the finance team have been informed about licence end dates so that they can budget for any renewal costs 
•    digital technology end-of-support dates are captured in the asset register 

How Bolton SICT Helps

BSICT includes licences for the following software within our services. 
•    Enterprise Antivirus
•    Enterprise Antivirus for Servers
•    Microsoft Office 365
•    Jamf Mobile Device Management
•    Adobe Creative Cloud

DfE Requirement – Security updates

IT support must complete security updates (known as patching) to operating systems, applications and firmware, including configuration changes, within 14 days of the release of the patch where the vulnerability is:

•    described as high risk or worse 
•    has a Common Vulnerability Scoring System (CVSSv3) score of 7 or above – you should also triage and prioritise updates for other scores when it is possible to do so

The CVSSv3 is the security industry standard for measuring the danger of a vulnerability. The score is a number from 1 to 10 where 10 means it is the most easily exploitable. There is a more detailed explanation of CVSSv3 on the National Vulnerability Database website.

IT support will also need to:

•    make sure security updates are applied on time – you may wish to consider using a supported third-party patch management tool to automate this process 
•    isolate devices where high-risk patches are unavailable – this could mean removing the device from the network or separating it from higher-risk systems and data

The NCSC has further guidance on the problems with patching. 

How Bolton SICT Helps

BSICT install security updates to your Microsoft Windows devices and your Enterprise Antivirus Protecting Against Malware and Malicious Software. Jamf MDM has a management console that can be used to update both operating systems and apps iPad devices.

DfE Requirement – Analyse where you are now 

It is useful to understand what your current backup plan looks like so that you can assess if it needs improvement.

The SLT digital lead should ask IT support:

•    what data is currently being backed up, how often, how old it is and how it is being backed up, this includes data stored on all your cloud services – this information should be stored in your information asset register 
•    what information is not being backed up
•    how often they test data that has been restored to check the backups are successful 
•    how long a restoration will take and when the last test restoration was completed 
•    how many copies are being kept and where they are located 
•    how your backups may be affected in the event of an incident or attack

If you do not have internal IT support, ask your service provider to explain what they are doing to help you achieve this standard. 

How Bolton SICT Helps

• All school data is backup and kept for 3 months.

•    Cloud accounts are not currently backed up but this feature is coming soon.

•    Test restores are carried daily by the backup solution.

•    Complete restore can take up to 24 hours.

•    Two copies of the backups are kept onsite and one copy is kept offsite.

•    We keep 3 months of backups as a minimum and 12 months maximum.

DfE Requirement – Plan and action on how to backup and restore data in the future

The SLT digital lead will work with your business professionals or the finance team, designated safeguarding lead, data protection officer and IT support to identify:

•    what data you backup, including what critical data and systems are needed to function as a school or college in a disaster situation 
•    how long can you go without specific systems and data and how up to date they need to be to find out the priority of recovery  
•    a process for students and staff to delete or archive data on an annual basis – this will speed up recovery times by getting rid of data you no longer need  
•    how long you will keep data for – this should align with statutory duties and retention policies so that you only backup what you need 
•    how you will deal with any statutory requirements, such as a freedom of information request or a data subject access request 
•    how and where you will backup your data

IT support should:

•    have at least 3 backup copies of important data, on at least 2 separate devices – at least one of these copies must be off-site (on large sites, these copies should be far enough away to avoid dangers from fire, flood, theft and similar risks)  
•    make sure that backups are immutable, this means that they cannot be changed once they have been created – this helps prevent data loss and reduces the risk of malware or ransomware being introduced into your systems when restoring data 
•    choose backup methods you will use based on your school or college’s budget and the identified needs in your backup plan 
•    test and log your backups termly or if there is a significant change, this should include the ability to recover and restore from backups – the NCSC has an online tool that will help you practice your response to an incident 
•    have a policy on how frequently restorations should take place to test the backup and how this will be reported to evidence success 
•    make sure, wherever possible, that restoring data is not device-specific and can be recovered to a wide range of hardware

You should not take any physical backups offsite unless they are encrypted and stored in a secure location. Regardless of whether they are encrypted, backups should never be taken to anyone’s home. 

How Bolton SICT Helps

The Department for Education (DfE) Digital Standard for Cloud Solutions encourages schools to adopt cloud-based services over traditional local systems to improve flexibility, reduce costs, and enhance accessibility. It emphasizes the importance of secure identity and access management, ensuring compliance with data protection regulations. Solutions should be reliable and available across various devices and locations, supporting remote and hybrid learning environments. Institutions must implement robust Data backup strategies to safeguard against data loss or corruption. Additionally, staff and users should be trained to use cloud systems effectively and securely. These standards aim to create a safer, more efficient digital infrastructure for education.

please contact us for more information about backup and restoring data in the future.

DfE Requirement – Report a cyber incident or attack internally 

As soon as IT support and the SLT digital lead have been alerted by a student or member of staff to a potential incident or attack they will need to:

•    action their cyber incident response plan which is a part of their business continuity and disaster recovery plans 
•    contain the risk and make sure systems are safe and secure 
•    notify those in the ‘who needs to be involved’ section of this standard and in line with their business continuity plan 
•    capture information on the risk 
•    investigate the risk and decide on the next course of action 
•    report the potential incident or attack to the governing body or trustees

Any incidents, attacks or near misses should be recorded in an internal incident report or system.

How Bolton SICT Helps

Sorry, there’s not a lot we can do to help with reporting internal cyber incidents or attacks. 

If it becomes clear that an incident is part of a serious attack we help in other ways. We can perform health checks for your public-facing services and anti-malware protection, run vulnerability scans of internal systems, assist with recovery or provide guidance.

There may be occasions where we’re aware of a cyber incident before you are. If this is the case we’ll always get in touch with you as soon as we can to let you know what the alert is, and to provide help in resolving it.

DfE Requirement – Plan and action on how to backup and restore data in the future

The SLT digital lead will work with your business professionals or the finance team, designated safeguarding lead, data protection officer and IT support to identify:

•    what data you backup, including what critical data and systems are needed to function as a school or college in a disaster situation 
•    how long can you go without specific systems and data and how up to date they need to be to find out the priority of recovery  
•    a process for students and staff to delete or archive data on an annual basis – this will speed up recovery times by getting rid of data you no longer need  
•    how long you will keep data for – this should align with statutory duties and retention policies so that you only backup what you need 
•    how you will deal with any statutory requirements, such as a freedom of information request or a data subject access request 
•    how and where you will backup your data

IT support should:

•    have at least 3 backup copies of important data, on at least 2 separate devices – at least one of these copies must be off-site (on large sites, these copies should be far enough away to avoid dangers from fire, flood, theft and similar risks)  
•    make sure that backups are immutable, this means that they cannot be changed once they have been created – this helps prevent data loss and reduces the risk of malware or ransomware being introduced into your systems when restoring data 
•    choose backup methods you will use based on your school or college’s budget and the identified needs in your backup plan 
•    test and log your backups termly or if there is a significant change, this should include the ability to recover and restore from backups – the NCSC has an online tool that will help you practice your response to an incident 
•    have a policy on how frequently restorations should take place to test the backup and how this will be reported to evidence success 
•    make sure, wherever possible, that restoring data is not device-specific and can be recovered to a wide range of hardware

You should not take any physical backups offsite unless they are encrypted and stored in a secure location. Regardless of whether they are encrypted, backups should never be taken to anyone’s home. 

How Bolton SICT Helps

BSICT schools that are eligible can benefit from access to Gridstore, BSICT’s cloud-based backup solution which meets all of the requirements for one of your backup devices. This will provide 50GB free of charge to primary and special schools and 100GB to secondary schools. This is an excellent way to protect your most critical data such as your MIS or Single Central Record.

For details about this and how to get more storage, please check here.