Cyber security does not appear anywhere in the top 10 challenges governors and trustees named for their schools and trusts in 2026.
That is the stand-out omission in the National Governance Association's (NGA) Annual School and Trust Governance Survey 2026, published in October 2026.
Yet in the same year, the government's own figures show cyber attacks on schools rising sharply. And the National Cyber Security Centre's (NCSC) Annual Review 2026, published on 3 November, finds that most successful attacks still exploit familiar weaknesses: exactly the kind good governance should catch. In this article we look at what the NGA survey tells us, why cyber resilience and data protection may be slipping off the boardroom agenda, and how a Data Protection Governance Lead can help close the gap. We look at what the review means for schools, and the free NCSC help available, in NCSC Annual Review 2026: what it means for schools.
What the NGA survey found
The survey is the largest of its kind, with over 3,000 governors, trustees and governance professionals responding in June 2026. It asks boards what pressures they face, and their answers are dominated by money, SEND and pupil numbers.
|
Top challenges named by boards in 2026 |
% |
|---|---|
|
Balancing the budget |
58% |
|
Support for pupils with SEND |
45% |
|
Attendance |
32% |
|
Falling pupil numbers |
27% |
|
Attainment of disadvantaged pupils |
18% |
Cyber security, cyber resilience and data protection do not feature in the top 10. The survey also did not ask about them directly: there are no questions on cyber incidents, data breaches, link governors or the DfE digital and technology standards.
Two other findings matter for anyone working in data protection:
- Risk management is the skill governors are least likely to say they have gained. Only 13% chose it, the lowest of eight options. Asking challenging questions came top at 65%.
- External reviews of governance are slipping. 13% of boards have never had one, and the average gap between reviews has grown from around 3.7 years in 2017 to about 5 years.
Schools say cyber is a governor priority. Governors don't mention it.
The DSIT and Home Office Cyber Security Breaches Survey 2025/2026, published in April 2026, paints a very different picture:
- 73% of secondary schools identified a breach or attack in the previous 12 months, up from 60% a year earlier and well above 43% of UK businesses.
- Almost all education institutions said cyber security was a very or fairly high priority for their governors or senior management.
- Most said they update their governors or senior management on cyber security at least quarterly.
So when schools answer the government's survey, cyber is a board priority. When governors answer their own survey, it doesn't make the list. Both can be true, and the gap between them is where the risk sits.
The National Cyber Security Centre's Annual Review 2026 points the same way. It handled 337 incidents in the year to August 2026, and found that most successful attacks still exploit the basics: unpatched systems, stolen passwords and people being tricked. It also warns that organisations with limited resources risk falling behind.
Why the gap exists
The two surveys ask different people. The breaches survey is usually answered by whoever looks after IT or cyber in the school, and it groups "governors or senior management" together. The NGA survey asks governors directly. From our work with schools and trusts, we see four likely reasons the message isn't reaching the board:
- Oversight is delegated and stops there. Cyber is left to the headteacher, business manager, IT provider or MAT central team, and the board is not necessarily involved.
- The quarterly update is noted, not scrutinised. A standing "IT update" item can pass without anyone asking what has changed or what the risk is.
- Governors lack confidence with technical risk. With only 13% saying they have gained risk management skills, many boards don't know which questions to ask.
- Cyber is seen as an IT problem. In reality a cyber attack is a data protection, safeguarding, business continuity and financial risk all at once, and the board is accountable for each of them.
None of this means boards don't care. It means cyber is competing with deficits and falling rolls for attention, and losing.
What the DfE expects of governors and trustees
The DfE cyber security core standard (updated September 2026) gives the board a clear role. KCSIE links it directly to safeguarding, and schools should be working towards all six core standards by 2030.
|
The standard says |
What it means for the board |
|---|---|
|
Conduct a cyber risk assessment annually and review every term |
The governing body or trust board provides oversight and strategic risk management. Cyber risks go on the risk register and into a regularly tested business continuity plan, and are flagged to the board. |
|
Create and implement a cyber awareness plan |
At least one current governor or trustee completes cyber training each year. The board approves the acceptable use policy. |
|
License digital technology and keep it up to date |
The board checks digital technology is fully licensed as part of its normal compliance review. |
|
Report cyber attacks |
Governors and trustees are informed of incidents, the risk and the actions being taken. |
The standard also points boards to the National Cyber Security Centre's questions for school governors and trustees. Schools with RPA cover must evidence that relevant users have completed the free NCSC cyber training annually.
AI: the same gap, again
AI was new to the NGA survey this year, and it shows the same pattern. 68% of schools and trusts have no AI policy, yet only 14% of governance professionals never use AI, mostly to transcribe and minute meetings. Governors and clerks both raised concerns about confidential information going into AI tools.
Bridging the gap: the Data Protection Governance Lead
The gap is not a lack of standards or guidance. It is a missing link between what happens in school and what reaches the board. That is the job of the Data Protection Governance Lead: the named person who leads data protection across the trust, runs its privacy programme and reports progress to the board.
The lead works with Data Protection Champions in each academy, who handle local matters and log issues.
|
The gap |
How the Data Protection Governance Lead helps bridge it |
|---|---|
|
Cyber is delegated and stops there |
Works with the SLT digital lead and IT on the data protection parts of the DfE cyber security and filtering and monitoring standards, and tracks progress |
|
Updates are noted, not scrutinised |
Reports progress against the ICO Accountability Framework, so the board sees what has changed and what is outstanding |
|
Governors lack confidence with risk |
Makes sure cyber and data risks are on the risk register with an owner, and brings the board clear, plain-English reporting |
|
Cyber is seen as an IT problem |
Connects cyber to data breaches, DPIAs, supplier checks and business continuity, keeping the information asset register aligned with the Record of Processing |
|
AI is used without a policy |
Keeps an AI tool register, makes sure DPIAs are done before adoption, and supports staff guidance, training and breach reporting for AI misuse |
DPE suggests every Data Protection Governance Lead complete the ICO's free Data Protection Essentials training as a minimum.
DPE resources to help
We have built a set of resources in the Knowledge Bank to help trusts set up the role and give boards the assurance they need.
Setting up the role
|
Resource |
What it helps with |
|---|---|
|
The Data Protection Governance Lead |
How the role works alongside the DPO, why independence matters, recommended training and a recruitment checklist |
|
Data Protection Governance Lead role description |
A ready-to-adapt description for a job pack, including the DfE digital and technology standards |
|
Data Protection Governance Lead Charter |
The shared commitments between the trust and DPE, including AI responsibilities |
|
Role card and "Who is your Data Protection Governance Lead?" poster |
Making the lead visible to staff across the trust |
|
Which DPE tools each role uses |
How the lead and the Data Protection Champions use DPE's tools |
|
Data Protection Champion resources |
Supporting the academy-level champions who report to the lead |
Cyber, risk and AI
|
Resource |
What it helps with |
|---|---|
|
DfE Digital Standards Roles and Responsibilities |
Who does what across the standards, including the governing body, DPO and SLT digital lead |
|
Cyber risk register template |
Capturing cyber risks with owners, aligned to the DfE cyber security standard |
|
What to do in the event of a cyber attack |
Who to report to, and when |
|
AI tool guidance for schools |
Using ChatGPT, Copilot, Gemini and Claude safely, with DPIA support |
|
Cyber Security Awareness Month 2026 series |
Daily cyber tips and articles to share with staff and governors |
|
Accountability Tracker and Governance Reporting |
Tracking progress against the ICO Accountability Framework and reporting it to the board |
|
The seven lessons from 337 incidents and free NCSC services for schools |
Questions for your next board meeting
If cyber isn't on your board's list of challenges, these questions will tell you whether that is because it is well managed or because no one is asking:
- Who is our Data Protection Governance Lead, and when did they last report to the board?
- When was our cyber risk assessment last done, and what changed at the termly review?
- Are cyber and data risks on our risk register, and who owns them?
- When did we last test our business continuity plan and backups?
- Has at least one governor or trustee completed cyber training this year?
- Do we have an AI policy, or AI covered in our data protection policy? Which AI tools are in use, and have they had a DPIA?
- Have we had any cyber incidents or near misses this year, and what did we learn from them?
For more, the NCSC's Cyber Governance for Boards toolkit sets out what boards should expect and the questions to ask, alongside its questions for school governors and trustees.
Sources
- NGA Annual School and Trust Governance Survey 2026 (October 2026)
- Cyber Security Breaches Survey 2025/2026: education institutions findings (DSIT and Home Office, April 2026)
- NCSC Annual Review 2026 (November 2026)
- NCSC Annual Review 2026: 7 things we learned
- NCSC Annual Review 2026: the impact of AI on cyber threat
- DfE cyber security core standard
- DfE digital and technology standards
- NCSC Cyber Governance for Boards
- NCSC questions for school governors and trustees
Disclaimer: These resources are for general educational purposes only and are provided "as is." While we strive for accuracy, Data Protection Education makes no warranties regarding completeness or suitability. Use of these materials does not constitute professional legal or data protection advice; please seek independent counsel for your specific circumstances. To the extent permitted by law, we are not liable for any losses arising from the use of these resources. All intellectual property remains with Data Protection Education; personal or internal organisational use is permitted subject to our terms and conditions.