A safer school login starts with the people who need access

Read the new passkeys story alongside the school guidance

NCSC’s annual review, published on 3 November, describes progress towards passkeys, which use cryptographic credentials tied to the legitimate service. It presents them as more resistant to familiar password weaknesses, including phishing. The review covers September 2025 to August 2026 and recalls its 2025 recommendation for individuals. That is a continuing direction, rather than a new November instruction to replace every school login.1

DfE’s autumn checklist, last reviewed on 29 October, asks schools to address expired or dormant accounts, staff MFA and current response arrangements. Its practical value now is a reason to check whether those arrangements still reflect the people and systems in use.2

DfE’s cyber core standard, in the manual updated on 16 September, sets out its recommended approach to England schools’ wider safeguarding expectations. Account protection is one element of that approach; the new NCSC publication does not create a separate universal passkeys duty.3

For a school, the opportunity is to make the access conversation more precise. Choose an important service and ask who needs it, which protection is actually enforced and what remains outside the arrangement. That establishes the question before anyone compares another product or subscription.

Choose a method people can use and the school can support

Start with the account and the work behind it. NCSC’s organisational guidance ranks authentication options by their protection, accessibility and usability, leading with FIDO2 credentials on a trusted device or security key. Suitability depends on what the service supports and what the organisation can provide and manage.4

DfE specifies MFA for staff reaching cloud services or accessing on-site systems remotely, and for IT administrative accounts. It identifies passkeys as a possible alternative where staff have a dedicated device, with alternatives or additional support considered for accessibility needs.3

Ask your technical lead to explain the choice. NCSC recognises that weaker MFA methods can remain susceptible to phishing or repeated approval prompts, while also stressing that MFA is better than relying on passwords alone. Cost and technical constraints matter. An improvement plan should make those constraints understandable without dismissing the protection already in place.5

A colleague moving between shared classroom computers may need a different arrangement from someone with an individually managed laptop. Establish what staff will use, who supplies it and who helps when it fails. Test the ordinary task with representative users before describing the rollout as complete.

Keep the account aligned with the role it serves

The core standard connects account creation and removal with role changes, human resources and business or finance colleagues. It also calls for termly account reviews and separates administrative work from routine accounts. These are continuing management tasks, not something a stronger login method can complete on its own.3

For a trust, ask how a move between schools reaches the central team and any locally purchased service. A maintained school may need to reconcile local-authority arrangements with its own applications. An independent school should include separately commissioned services. The account owner needs a clear route through those relationships.

Make temporary and agency access part of the same discussion. Who requests it, what work does it permit and who confirms when it ends? Shared equipment need not mean that responsibility for an account becomes unclear. Ask the support team how activity remains attributable and how an exception is approved.

Include the colleagues who may need a different way to authenticate. The useful outcome is a secure arrangement they can operate with confidence. Record any remaining limitation, the person responsible for resolving it and the interim position that leadership has accepted.

Governors do not need lists of credentials. They need to understand whether the review covered the relevant services and whether significant exceptions have a decision. Keep the technical detail with those responsible for it, while making the consequence and resource request clear enough to challenge.

Know how the right person regains access

Walk through a lost-device scenario with your support team. How does the colleague ask for help, how is their identity verified and who can authorise the change? Consider an interruption outside office hours where the service supports boarding or another continuing activity. The recovery route should not depend entirely on the unavailable account.

Keep sensitive recovery details in protected technical records. Leaders need an intelligible account of who can act and what the school does meanwhile. A fallback for an essential task should identify authorised information access and how any temporary records will be reconciled afterwards.

A cyber specialist can help establish account coverage, configure suitable authentication, investigate exceptions and test recovery with existing providers. Define the question and the expected evidence. Ask for an explanation of what improved, what remains constrained and who will maintain the result, rather than only a statement that a feature was enabled.

Record the scope of the exercise and what happened, including any delay or manual step. A successful reset for one account cannot establish that every service will recover. Use the result to agree the next improvement and the point at which it will be tested again.

Bring those findings to the next review. The school should know how important access is protected, which exception still needs an owner and what a tested return has demonstrated. That leaves staff better supported and leaders able to explain the protection they are relying on.