Begin with work that matters to the school
Choose one function whose interruption would have a serious practical consequence: recording attendance, accessing essential safeguarding information or communicating with families. Name the function before the software. This keeps the discussion connected to people and decisions, even where several applications or organisations help deliver it.
Write what successful operation means, who relies on it and when. A boarding service may be needed after the office closes; an assessment process may become particularly time-sensitive during a defined period. This card is School Connection’s suggested planning method. It is not an asset audit or a declaration of compliance.
Put the operational and technical accounts together
Ask the school’s service owner and technical support to describe the same function. The operational owner explains the work and its consequences. Technical colleagues establish which systems and external parties make it possible. Record where their responsibilities meet, who coordinates an exception and how a deputy obtains an answer.
Use existing records rather than starting another inventory project. A trust may combine central provision with local purchases. A maintained school may need local-authority input. An independent school may have separate admissions, finance or residential agreements. The card should explain the arrangement that actually supports this service.
Follow the important dependencies
Trace the route from the authorised user to the information and action required. Ask about identity, connectivity, applications, integrations, power and external support where relevant. Identify shared dependencies that could affect other school functions. Competent technical staff should confirm the explanation; an application name alone cannot reveal the complete route.
Keep passwords, recovery codes, detailed configurations and sensitive network information outside this card. Link to approved technical records with appropriate access. A leadership record needs enough information to make a decision without becoming a widely circulated description of how to enter or administer school systems.
Describe an interruption in school terms
Ask what staff would do if the normal route were unavailable. Establish the approved alternative, the person who authorises it and how essential information remains protected and sufficiently current. Record which activities would pause or operate differently. Avoid assuming that a telephone call or paper record solves every part of the service.
Then ask what the latest exercise or restoration test established. Keep a rehearsed decision separate from a demonstrated technical recovery. An unanswered question can remain open, provided someone owns the next step. Do not fill a gap with a confident conclusion simply to complete the card.
Leave one decision someone can carry forward
Record the evidence date, the remaining limitation, the decision required and the person with authority to make it. Agree a proportionate next action and a way to check completion. Bring significant resource or responsibility questions to leadership, with the operational consequence explained plainly.
Keep the card in an approved location and revisit it when the service, provider, owner or important dependency changes. A useful finish is a shared account another colleague can understand. Extend the method to further services as capacity permits, using the findings to improve support and continuity rather than to produce a single readiness score.
Prepare the working record
Use the editable CSV or the PDF pack with your colleagues. Record decisions and evidence references, keeping credentials, sensitive configurations and personal records in the school’s protected systems.
- School function
- What work must people be able to complete, and why does it matter?
- Users and hours
- Who relies on it, at which sites and times, including residential or assessment periods where relevant?
- Operational owner and deputy
- Who owns the school function, and who acts during absence? Store personal contact details through approved arrangements.
- Technical parties
- Which internal teams, authority, trust services or external providers support it? Who coordinates a question across them?
- Important dependencies
- Which identity, connection, application, integration, power or support dependencies have competent staff confirmed?
- Access responsibility
- Who approves and reviews the roles permitted to use or administer it? Do not record credentials or sensitive configurations.
- Consequence and priority
- What would interruption affect, and who determines the operating and recovery priority?
- Approved alternative
- What can staff do while the usual route is unavailable? Where are the protected instructions held?
- Evidence and date
- What assurance, exercise or restoration evidence was examined, by whom and when?
- Remaining question
- What is unknown or unresolved, and what evidence would help settle it?
- Next decision and owner
- What action, authority or resource is needed, who owns it and when will it be reviewed?
- Verification and review trigger
- How will completion be checked, and which change will bring the card back for review?
The blank records are completed locally. They are not automatically submitted to School Connection and do not constitute a compliance certificate.
Official guidance and connected reading
- DfE Cyber Security Hub ↗
Official school resources. This service card is School Connection’s own method for preparing a local conversation.
- DfE cyber security core standard ↗
England guidance on coordinated leadership, technical responsibilities and risk management; assess its application alongside the school’s duties.
- NCSC incident planning, response and recovery ↗
General organisational guidance. Local operating arrangements and technical recovery need their own verification.
- Follow the service beyond the supplier’s reply ↗
Our connected feature explains why a service can cross several support agreements.
- The continuing identity and access review ↗
Our programme continuation connects accounts and authorised access with the school services people rely on.