School Connection / Feature
The PHP alert reaches Parliament: who can assure your school's digital services?
The Lords exchanges connect the PHP alert with public-service continuity and supplier responsibility. School and trust leaders can use that evidence to examine the assurances behind their own essential digital services.
The answer in brief
Move from a supplier response to an accountable school decision
A school can receive a confident assurance from its IT provider while remaining uncertain about the services on which tomorrow morning depends. That gap is the subject of this continuation. Our earlier PHP features examined the alert and verification of corrective work. The parliamentary exchanges now give leaders a reason to connect that technical response with authority, contracts and the school day.
At a Private Notice Question on 22 October, the minister reported 32 government services unavailable and four partly unavailable, largely following precautionary shutdowns, and 50,000 NCSC notifications. She said no UK compromises were known then. These are historical statements, not current counts or local assurance.1
- Map central and local service responsibilities before accepting a trust-wide assurance.
- Test one school-day interruption with the colleagues who would respond.
- Keep parliamentary statements, proposed law and local verification distinct.
01 / The evidence
What the parliamentary record adds
Education questions concerned UCAS, universities and awarding bodies. The minister recommended leadership and supplier assurance. Our school application is editorial analysis, not a parliamentary finding of school breaches. Hansard records statements rather than independently verifying every assertion.1
The useful shift is towards an accountable answer across an organisation. A trust executive does not need to inspect code to ask who owns a service, who can suspend it and what evidence permits restoration. Those questions should connect the provider’s work with the authority retained by school and trust leaders. A reassuring message is useful only when its scope can be understood.
02 / A worked scenario
Follow a fictional trust through one interrupted morning
Consider a hypothetical trust whose centrally procured parent portal is paused for precautionary work. One school also has a separately hosted website, while another uses an additional booking application. The portal provider confirms its work, but that confirmation says nothing about the other services. This example is illustrative; it does not describe an actual affected trust.
The trust’s digital lead should identify the service boundary behind each assurance. The school business professional should identify the relevant agreement and contact. Local leaders should establish how urgent messages and changes reach families while the normal route is unavailable. The safeguarding lead should check whether any necessary communication relies on that route and agree an appropriate alternative.
The first governing question is therefore whether the shared assurance covers the whole dependency map. Record separately what the central team controls, what individual schools procure and what another organisation supplies. A trust-wide green status should not hide a local unanswered question. Conversely, an unresolved optional application should not automatically imply that every essential service is unavailable.
03 / Responsibilities
Give the interface between suppliers an owner
Ask each relevant provider to identify its responsibility for the application, hosting environment, updates, monitoring and recovery. Where several organisations contribute, establish who coordinates the answer. A hosting provider may maintain infrastructure while an application provider maintains the software. A school needs the interface explained, rather than an exchange in which each party confirms only its own narrow task.
Keep one short exception record showing the service, unresolved question, responsible person, temporary arrangement and next decision time. Give the executive a route for resolving disagreements about scope or expenditure. Do not circulate passwords, detailed configurations or unnecessary pupil information with the board summary. Technical evidence belongs in an appropriately protected record, with a proportionate explanation for governors.
04 / Service continuity
Test the alternative before accepting the reassurance
Walk the scenario through arrival, lunchtime and the end of the day. Can families receive a genuine message? Can staff distinguish the alternative channel from impersonation? Does a changed telephone instruction reach temporary colleagues? The exercise should establish the minimum workable service and identify where a handover depends on the system that has been paused.
If access to an essential record is affected, involve the information-governance and safeguarding leads in agreeing authorised access, currency, protection and reconciliation. Avoid producing uncontrolled copies merely to demonstrate preparedness. Record what colleagues actually showed, which part failed and who will correct it. A small failure found during a rehearsal is useful evidence for improvement, not a reason to conceal the exercise.
05 / Evidence and oversight
Build a pack that supports a decision
The supplier-assurance pack should contain a service list, a responsibility map, references to verification evidence, outstanding exceptions and a continuity result. Its purpose is to help leadership decide what can resume, what remains temporarily protected and what requires further specialist work. A dated response should name its scope and limitations, rather than make an unqualified statement that everything is secure.
NCSC’s board toolkit places critical assets, supply-chain relationships, incident planning and assurance within governance. It supports this direction of review, but our proposed pack is not a prescribed national school form. Adapt it to the size of the organisation and the services involved. Ask governors to test the completeness of the decision record, while competent staff and providers retain technical work.3
06 / A maintained response
Make an alert reach someone who can act
NCSC’s Early Warning service provides UK organisations with notifications associated with registered network information. It should complement existing controls, not become the only defence. Before enrolling or relying on an existing registration, establish the correct addresses and domains, the contacts receiving alerts and who can interpret and escalate them. A notification in an unattended mailbox is not an operating response.4
Agree cover for absence and out-of-hours escalation where the service requires it. Record who contacts the provider, who authorises expenditure and when a school leader must be informed. The test is a complete route from warning to decision, not simply evidence that an account exists. Review whether that route also works for services procured separately by individual schools.
07 / Policy and practice
Keep the Bill separate from today’s contract
The parliamentary stage record lists Lords report stage on 26 October, with third reading scheduled for 2 November. The Bill remains in progress; its proposed supplier requirements should not be described as duties already imposed on every school or IT provider. This feature does not claim that a particular report-stage amendment has created a new obligation.2
At report stage on 26 October, amendments 30, 35 and 40 were agreed. They would require relevant data-centre, digital-service and managed-service providers to give customers further incident updates after initial notification, as the provider considers necessary. These remain Bill provisions, not a new universal reporting timetable already in force. For our fictional trust, the practical question is who will supply the next useful update while the service remains unavailable.5
Schools can review current contract wording without waiting for legislation. Ask whether emergency updates, communication during disruption, evidence of completion and recovery responsibilities are sufficiently clear. Obtain appropriate procurement or legal advice where an amendment is needed. A future regulatory direction may sharpen the question, but it does not replace examining the agreement under which the service operates now.
08 / Next steps
Bring the unresolved decisions back within a week
Within the next working week, ask the digital lead and school business professional to assemble one pack for the most important affected or potentially relevant services. Run one continuity scenario with local leaders. Bring unresolved ownership, evidence or resource questions to the accountable executive, with the advice received and a dated next step.
Commission additional help where the review establishes a gap. That may mean authorised independent verification, continuity testing, incident-response preparation or contractual clarification. Define the deliverable and who will act on it. The useful outcome is a school or trust able to explain its dependencies and decisions accurately, with a response that colleagues can operate when the familiar service is unavailable.
From evidence to action
School and trust supplier-assurance pack
Use this working record with the relevant leaders. Add your findings, evidence reference, action, due date and verification. Suggested owners should be adapted to your organisation.
| Review area | Suggested owner | Question to resolve |
|---|---|---|
| Service boundary | Digital lead | Which essential services, schools and environments does the assurance cover? |
| Responsibility | Business professional | Who owns application, hosting, updates and recovery, including interfaces? |
| Evidence | Technical provider | Where is the dated verification record and what are its limits? |
| Exceptions | Digital lead | What remains unresolved or temporarily protected, with owner and next date? |
| School-day continuity | Safeguarding and operations | What alternative handover did colleagues actually demonstrate? |
| Warning route | Digital lead | Who receives, interprets and escalates relevant alerts during absence? |
| Authority | Accountable executive | Who can authorise suspension, restoration and necessary expenditure? |
| Closure | Headteacher or trust executive | What evidence permits closure and when will unresolved decisions return? |
Leadership questions
Questions that turn the development into a governing conversation.
Board test
Which services are outside the central supplier’s assurance?
Board test
Who resolves an interface between the application and hosting providers?
Board test
What did colleagues demonstrate during the continuity exercise?
Board test
Which exception requires an executive decision and when?
Evidence boundary
What this analysis does not prove.
- This is a School Connection leadership review, not a finding that a school or trust was compromised.
- The worked trust scenario is fictional and illustrative; no new school interviews or technical tests were undertaken.
- Hansard figures and statements are dated 22 October, not current outage or breach measurements.
- The Bill remains in progress; no new universal school duty is inferred.
What we are monitoring next
Publication is the beginning of the watch.
- Verified PHP and NCSC technical developments that materially change required checks.
- The Bill’s third reading and subsequent parliamentary decisions, with implementation dates kept separate.
- Documented service-continuity lessons that can be shared without exposing sensitive school information.
Approved public intelligence
What the live evidence is showing now.
Gigabit is coming to more schools. The connection is only the beginning.
The DfE's new gigabit programme is an opportunity to close a stubborn infrastructure gap and strengthen the digital foundations schools increasingly depend on. Our analysis shows where the opportunity is greatest, what changes operationally when connectivity improves, and what school and trust leaders should be thinking about now.
A stronger connection is valuable because it changes what a school can reliably depend on. The opportunity is not simply faster internet.
This panel reads only the editor-approved School Connection public feed. It never exposes raw Observatory records, private candidates, contacts, commercial opportunities or internal scores.
Continue the evidence trail
Follow the question through the series
Sources and methodology
Evidence used in this analysis
School Connection links to the primary source behind each material claim. Source status, period and limitations are stated so readers can reproduce the evidence trail.
- 01
UK Parliament, Hansard · 22 October 2026; reviewed 27 October
Cyber Security: PHP Vulnerability
Private Notice Question and ministerial exchanges. Figures and no-known-compromise statements describe that date; the record is not an independent verification of every speaker’s assertion. - 02
UK Parliament · Stage record checked 27 October 2026
Cyber Security and Resilience Bill: parliamentary stages
Lords report stage listed 26 October; third reading scheduled 2 November. Proposed requirements are not described as operative law. - 03
National Cyber Security Centre · Reviewed by NCSC 8 April 2025; checked 27 October 2026
Cyber Security Toolkit for Boards
Standing governance context for critical assets, supply chains, response and assurance; not a new school-specific requirement. - 04
National Cyber Security Centre · Current service description checked 27 October 2026
Early Warning
A complementary notification service, not a complete defence or confirmation that all relevant systems are covered. - 05
UK Parliament, Hansard · 26 October 2026; reviewed 27 October
Cyber Security and Resilience Bill: Lords report stage
Clause 16, amendments 30, 35 and 40 agreed: continuing customer updates within the proposed framework. No universal frequency or commencement is inferred.