Education IT Support
Meeting the DfE Cyber Security Standards for schools and academies
In4ra helps schools, academies and multi-academy trusts understand and meet the Department for Education's Cyber Security Standards, without it taking over your IT team's time or your budget.
What Are The Standards?
Government guidance for school cyber security
The Department for Education's Cyber Security Standards form part of its wider Digital and Technology Standards for schools and colleges. They set out the governance, processes and technical controls schools and colleges are expected to have in place to protect data, reduce the risk of cyber incidents and keep learning running smoothly.
Responsibility is shared: a senior leadership team digital lead is expected to prioritise and coordinate cyber security, while IT support, whether in-house or outsourced, is responsible for putting the technical controls in place. In4ra works alongside your leadership team to cover both sides.
The Standards
What the DfE expects schools to have in place
The standards cover seven core areas of cyber governance, process and strategy, designed specifically for the education sector.
Cyber Risk Assessment
Conduct a cyber risk assessment annually, reviewed every term, so emerging risks are identified and managed before they turn into incidents.
Security Controls
Firewalls, anti-malware and secure configuration applied consistently across school devices and cloud-based services.
Licensing & Updates
Keep all software and digital technology properly licensed, supported and patched, with security updates applied promptly.
Access Control & MFA
Multi-factor authentication and managed user accounts, so staff and pupils only have access to the data and systems they actually need.
Backup & Recovery Plan
A documented, tested plan for backing up and restoring critical school data and systems, reviewed at least once a year.
Staff & Governor Training
Annual cyber security training for staff, governors and anyone with network access, covering phishing, passwords, social engineering and safe use of devices.
Reporting Cyber Attacks
Clear internal and external reporting routes for cyber incidents, including notifying the DfE, the ICO and Action Fraud where required.
Shared Responsibility
Cyber security isn't IT's job alone
The DfE is clear that cyber security cannot be carried out by IT teams in isolation. It's treated as a shared responsibility between leadership and IT support, with clear ownership on both sides.
In4ra works with your SLT digital lead, DPO and safeguarding lead to make sure governance and technical controls move forward together, rather than IT implementing changes in a vacuum.
Senior Leadership Team
The SLT digital lead is accountable for prioritising and coordinating cyber security activity across the school, working with the DPO, safeguarding lead and finance team.
IT Support
IT support, whether internal or an external provider like In4ra, is responsible for implementing the technical controls the standards require.
How In4ra Helps
A practical path towards meeting the standards
Rather than handing you a checklist and leaving you to it, we work through the standards alongside your team, prioritising the areas that carry the most risk first and building from there.
This sits alongside our wider cyber security and education IT support services, so the standards become part of how your school's IT already runs, rather than a separate project.
We can help your school:
DfE AlignedRun a cyber risk assessment and put a clear remediation plan in place
Configure firewalls, anti-malware and secure device settings across your estate
Keep software and devices licensed, supported and patched on schedule
Roll out multi-factor authentication and tidy up user access and account management
Design and test a backup and disaster recovery plan for critical school data
Deliver annual cyber awareness training for staff and governors
Put incident reporting routes in place, covering the DfE, ICO and Action Fraud
Support you through Cyber Essentials certification
Certification
Cyber Essentials for schools and colleges
Cyber Essentials is a government-backed certification covering five core technical controls, and is a requirement for colleges under their ESFA funding agreement. It is increasingly treated as the expected baseline for schools and academy trusts too, reinforcing many of the technical requirements within the DfE standards.
In4ra can support your school or trust through Cyber Essentials certification, from an initial readiness review through to submission.
Not Sure Where You Stand?
Let's review your school against the DfE standards
We'll help you understand where your school or trust currently stands, what needs attention first, and how to close the gaps without overwhelming your IT team.