Cyber recovery must protect the work pupils are relying on

Welcome faster recovery, then ask what the school recovered

Ofqual’s release on 1 October reports immediate recovery at 66%, up from 55% in the previous academic year. Teacher Tapp conducted the poll on 13 July 2026 among 3,775 secondary teachers in England. School-level percentages used one response per school, selecting the most senior teacher, representing up to 2,162 schools. These are reported experiences, with no independent-school incidence estimate or technical verification of recovery.1

That improvement deserves recognition. The next school-level question is what the reported recovery allowed pupils and staff to do. An account of a short interruption can inform a useful review, provided leaders establish which service returned, what remained unavailable and how the position was checked. A headline recovery time leaves those educational details open.

Keep the poll within its own population and questions. It should not be blended with a separate business survey to produce an apparent school trend. For the school’s decision, use the national finding to begin a conversation with the people responsible for the actual assessment process.

Follow the work through the whole assessment journey

Start with one assessment approaching an important deadline. Follow the pupil’s work from its authorised storage through marking, internal checks and submission. Ask the people involved to explain where the current version sits, who can use it and what would happen if the usual account or system became unavailable. This is a suggested school review, rather than a finding that any particular arrangement is weak.

The educational judgement and the technical assurance need to meet. Subject staff can explain which work or marks the school is relying on. The exams officer understands the applicable submission route and deadline. IT support can establish what was restored and identify uncertainty about versions or access. Together they should be able to explain whether staff can safely continue the next assessment task.

Include the DPO where personal information or its handling is affected. Keep the review within authorised records and access arrangements. In an independent or boarding school, consider when work, support and communication happen beyond normal office hours. Across a trust, establish whether several schools depend on the same service or recovery team. Those circumstances can change who needs to be available when the decision is made.

Communication with pupils belongs in this plan. Agree who will explain a material interruption, what can be said confidently and when an update will follow. Where uncertainty remains about work or a submission, keep it visible to the responsible staff. Reassurance is more useful when it is tied to a checked position and a clear next contact.

Make the examination requirements visible in everyday practice

JCQ’s General Regulations are effective from 1 September 2026. They apply to approved centres delivering the qualifications within their stated scope. The head of centre must ensure annual cyber training for centre staff who access awarding bodies’ online systems. This continues the training expectation in JCQ’s August 2025 cyber guidance.23

Within that scope, MFA must be used where available for all accounts and systems containing exam-related information, including interfaces between centre and awarding-body systems. Where MFA is unavailable on centre systems, equivalent layered protection is required. Ask the responsible technical team to explain how those requirements are met in the services your centre uses.2

The 2026/27 changes make the evidence explicit: completed training must be recorded for inspection, and a written cyber security policy must be available. These are centre requirements with defined scope. A training record can demonstrate completion; leaders still need confidence that staff understand the arrangements they use.2

Bring that distinction into the assessment review. Check the staff who use awarding-body services, their deputies and the people who manage access. Ask how an account problem reaches someone able to resolve it before the deadline. Where a system cannot support the usual protection, seek a clear technical explanation of the alternative and how it is maintained. The head of centre needs an intelligible account of those arrangements alongside the examination plan.

Rehearse the handover that protects the next assessment decision

NCSC’s business-continuity preparation guidance, published on 1 October, recommends identifying critical services, their dependencies, feasible workarounds and restoration priorities. Its companion critical-decisions chapter, also dated 1 October, addresses decision authority, escalation and alternative communications. Applied proportionately to a school, these provide a useful basis for an assessment-continuity exercise. They are organisational guidance, rather than new examination rules.45

Choose a manageable scenario with the exams officer, a subject lead and IT support: an important assessment service becomes unavailable near a submission point. Establish who checks the work available, who verifies recovery and who decides the next operational step. Include the deputy arrangements and communication with the relevant awarding body through its applicable procedures. Keep any real pupil information protected throughout the exercise.

Where specialist help is useful, commission it around that question. An expert can test restoration, examine the dependencies and help rehearse the handover with existing support. Agree the scope, evidence and unresolved decisions the work should leave. Governors need assurance about the school’s capacity to respond, with sensitive assessment and personal information confined to the appropriate staff.

Finish by deciding which gap must be resolved before the school relies on the arrangement. Give that decision an owner and a review point linked to the actual assessment calendar. The practical gain is confidence staff can explain: where the pupil’s work is protected, how the next step can continue and who will act if the expected recovery falls short.