Six standards, one trust-wide view: digital readiness can now be planned across more than one school

01 / What changed

The 8 September update joins planning and practical support; it does not create a new compliance badge.

The standards manual now directs users of the cyber core standard to the DfE Cyber Security Hub. The Hub groups resources under four practical routes: strengthening cyber security, creating a response plan, following processes for specific incidents, and finding awareness resources and support. The change is easier access to operational material, not evidence that a school has implemented it.257

Plan Technology already allowed schools and trusts to complete self-assessments, receive recommendations and track progress. Its 8 September update adds that MATs can complete and submit assessments for more than one school at a time. Anyone with a DfE Sign-in account for the school or trust can use the service without adding it or obtaining access approval, and DfE says information from the service is not shared with Ofsted.3

02 / Trust-wide, not uniform

A portfolio view is valuable because schools differ, not because they can be treated as one site.

A multi-school submission can give trust leaders a consistent baseline, make common gaps visible and support sequencing across budgets and contracts. It can also reveal where one supplier, administrator account, internet route or recovery dependency creates concentration risk across several schools. DfE's cyber standard expressly warns that an incident may affect other schools on a broader organisational network.35

The control remains local as well as central. A trust-wide firewall contract does not prove the filtering profile suits each pupil cohort; a common backup product does not prove every school can restore; and a shared wireless design does not prove coverage in a particular building. Record one answer per school where site conditions matter, then aggregate the evidence without erasing exceptions.

03 / Six connected controls

The six standards are a dependency system, and they do not all share the same urgency.

Broadband, wireless and switching form the service path. Leadership and governance establishes accountability, current information, continuity and a strategy led by educational and organisational needs. Filtering and monitoring connects the technical estate to safeguarding. Cyber security covers risk assessment, awareness, protective controls, accounts, updates, backup and incident reporting. Weakness in one layer can undermine apparently strong performance in another.1456

The 2030 phrase must not be read as permission to defer everything. DfE's filtering and monitoring page says schools and colleges should already meet that core standard because they have a statutory responsibility to keep children safe online as well as offline. By contrast, the cyber page describes standards for all settings and distinguishes Cyber Essentials certification: it is required for colleges under their funding agreements, while some schools may choose it.56

Within the cyber standard, DfE says a cyber risk assessment should be conducted annually and reviewed every term. It places accountability and coordination with the SLT digital lead while IT support actions the technical work. That allocation prevents cyber resilience being treated as either an IT-only task or a board-only declaration.5

04 / From assessment to assurance

Turn recommendations into a controlled programme and test the claims that matter most.

A completed self-assessment is a baseline. Assurance begins when the trust can connect each material answer to current evidence, an accountable owner and a test result. Use the Hub's response-plan route to structure preparation, but do not stop at a completed template: exercise decision-making, communications, safeguarding continuity, restoration and supplier escalation under realistic loss-of-service conditions.378

• Complete the six-standard baseline for every school and timestamp the evidence behind each answer.
• Separate trust-wide controls from site-specific conditions, recording shared dependencies and local exceptions.
• Prioritise current safeguarding gaps and high-consequence cyber or continuity failures before cosmetic standardisation.
• Give every recommendation an owner, due date, cost, prerequisite, acceptance test and review cycle.
• Run a trust-level cyber exercise that tests school escalation, unavailable systems, backup restoration and cross-site containment.

Leadership questions

Questions that turn the development into a governing conversation.

School Connection intelligence lens

What the national Observatory can add, and where it must stop.

School Connection can connect dated changes in DfE standards, published trust and school characteristics, connectivity context and recurring public incident evidence. That can show where leaders need to investigate a dependency; it cannot see private configurations, test backups or certify control effectiveness.123

A useful trust view should retain school-level provenance, assessment date, control owner, evidence state and last test. School Connection will distinguish DfE wording from its own prioritisation and will not turn a self-assessment into a public cyber rating.

What we are monitoring next

Publication is the beginning of the watch.

• Further DfE changes to the six core standards, Plan Technology's multi-school workflow and Cyber Security Hub resources.
• Evidence that MAT-wide assessments are producing funded action, closed gaps and tested recovery rather than higher completion counts alone.
• Changes in Cyber Essentials, safeguarding, filtering and incident-reporting requirements that alter the boundary between guidance, funding conditions and statutory duty.