Running a college or university? Broadband for Education

Broadband for SchoolsInternet connectivity for schools, explained — home
Menu

Core standard

Cyber security for school networks

The parts of DfE’s cyber security standard that touch your internet connection: the boundary firewall, patching, multi-factor authentication, backups, training, reporting an attack — and the NCSC’s free protective DNS for schools.

  • Checked 25 October 2026
  • Applies to: England (NCSC services: UK)
  • 2 min read
  • 4 sources
On this page

At a glance

  • Governors should make sure there are appropriate cyber security systems (KCSIE 2026, paragraphs 178 to 180).
  • The boundary firewall should block unauthenticated inbound connections by default, with rules reviewed every term.
  • Critical or high security fixes: within 14 days of release.
  • Backups: 3 copies, on 2 separate devices, 1 off-site, tested every term.
  • The NCSC’s Protective DNS for Schools is free; your DNS provider registers for it.

KCSIE 2026 says governors should make sure their school has appropriate cyber security systems, and that schools should consider measures in line with DfE’s cyber security standards (paragraphs 178 to 180). It also points to the National Cyber Security Centre (NCSC) and the National Education Network for guidance. This guide covers the parts of DfE’s cyber security standard that matter most when you buy connectivity.

Risk assessment and response plan

DfE says to carry out a cyber risk assessment every year and review it every term. If your school is covered by the DfE Risk Protection Arrangement (RPA), keeping a cyber response plan is a condition of that cover. Colleges must hold Cyber Essentials under their funding agreement; schools may choose to work towards it.

The boundary firewall

Your firewall sits between the school network and the internet. The standard says it should block unauthenticated inbound connections by default, that the rules allowing inbound traffic should be reviewed every term with sign-off from the senior leadership team’s digital lead, and that its firmware should be kept supported and up to date. DfE says this “should already be in place”.

Patching, accounts and backups

  • Patching: apply critical or high security fixes (CVSS v3.1 score of 7.0 or above, or with no rating) within 14 days of release, and apply DfE security instructions within 5 working days of being told.
  • Multi-factor authentication for cloud services, remote access and admin accounts. Review accounts every term.
  • Backups: three copies, on two separate devices, one off site. Backups should be immutable and tested every term, including a restore.

Training

Cyber awareness training at least once a year for pupils, staff and at least one governor or trustee. RPA members must show that the relevant people completed the NCSC’s free training each year.

If you are attacked

Tell IT support and your digital lead, start your response plan and inform governors. Report externally to:

  • the RPA or your cyber insurer;
  • Report Fraud on 0300 123 2040 (DfE’s page now uses this name instead of “Action Fraud”);
  • DfE’s sector cyber team at Sector.Incidentreporting@education.gov.uk.

Also consider the NCSC, and the Information Commissioner’s Office within 72 hours for a high-risk data breach.

Free help from the NCSC

Protective DNS (PDNS) for Schools is free and centrally funded by the NCSC. Since October 2024 it has been open to:

  • local authorities in England that provide DNS to maintained schools;
  • local authorities or public sector networks in Scotland, Wales and Northern Ireland that provide DNS to their schools;
  • school internet providers in England with wide reach;
  • trusts, academies and independent schools that don’t get DNS from those providers and can set it up themselves.

Your DNS provider signs up through MyNCSC. The NCSC’s schools pages also offer free staff training, questions for governors and trustees, Cyber Essentials, the free “Check your cyber security” service, Exercise in a Box and resources for pupils.

Sources

Checked 25 October 2026. We wrote this guide from these sources, in our own words:

  1. DfE: Cyber security core standard (gov.uk)
  2. Keeping children safe in education 2026 (PDF) (assets.publishing.service.gov.uk)
  3. NCSC: PDNS for Schools extended to more institutions (ncsc.gov.uk)
  4. NCSC: Cyber security for schools (ncsc.gov.uk)

Broadband for Schools is an independent guide. We are not a broker, a reseller or a supplier, and we are not connected to the Department for Education, any local authority or any provider. Spotted something out of date? Tell us.

More in “Standards & safeguarding”