You cannot protect what you do not know you have. Every unmanaged device on a network is a gap nobody’s actively watching, not because anyone decided to leave it unwatched, but because nobody wrote it down in the first place.
What the DfE standard actually requires
Asset management sits at the heart of the Digital Leadership and Governance: Core Standard, which requires schools and colleges to keep an up-to-date information asset register (IAR), owned by the data protection lead, with IT support updating it whenever digital technology changes. The Cyber Security: Core Standard adds the technical detail: every device must be known, recorded, correctly configured, and kept up to date, with security features enabled rather than left on default settings.
What a proper register actually needs to capture (this is all listed in the standard):
- Hardware: make, model, serial number, location, assigned user, purchase date, warranty information.
- Software: operating system version, installed applications, licence keys, patch status.
- Network: IP addresses, network segment, connection type.
- Security status: antivirus status, encryption status, whether MFA is enabled.
Why this isn’t just admin
An asset register does four jobs at once, and schools often only use it for one:
- Visibility: stopping “shadow IT,” the unauthorised devices and software nobody signed off, from quietly appearing on the network.
- Vulnerability management: spotting end-of-life hardware and software before it becomes the thing a patch can no longer reach, tying directly back to the 14-day patching rule covered earlier in this series.
- Risk assessment: linking specific assets to the data they hold, so the most business-critical systems get the strongest protection rather than a flat, one-size approach.
- Incident response: when something goes wrong, a current register is the difference between containing a breach in minutes and spending the first few hours just working out what’s actually connected.
Controlling what joins the network in the first place
This connects directly to the application and supplier controls covered earlier in the series: an approved application list, software verified as coming from known suppliers, and a process for onboarding new devices that updates the register automatically rather than relying on someone remembering to. The same discipline applies in reverse: leavers’ and loan devices’ processes should wipe, reset, and remove the device from the register as a matter of course, not as an afterthought once someone notices it’s still showing as active.
Who’s accountable
IT support is Responsible for maintaining the day-to-day accuracy of the register and flagging end-of-life hardware. The DPO owns the information asset register itself and is Consulted on how it’s structured, since it’s as much a data protection document as a technical one. The SLT digital lead is Accountable for making sure the register actually reflects reality, not what was true at the last audit. Governors are Informed, and the NCSC’s governor questions covered earlier in this series (does the school know its critical digital services?) are, in practice, a question about whether this register exists and is trustworthy.
💡Daily Cyber Tip
Pick five random devices on your network and check whether they’re actually on your asset register, correctly. If any of them aren’t, that’s not a one-off gap, it’s a sign the onboarding process isn’t catching everything it should.
Don’t forget the devices that aren’t “IT”
Asset registers tend to default to laptops, servers, and classroom devices, and quietly skip over everything else connected to the network that isn’t thought of as IT equipment:
- CCTV systems: cameras and recorders are networked devices with their own firmware, default passwords, and (often) cloud storage attached. An unpatched camera is just as much an entry point as an unpatched laptop, and footage is personal data in its own right.
- Door entry and access control systems: electronic fobs, keypads, and visitor-badge printers are frequently networked, frequently supplied and maintained by a third party, and frequently absent from the register because “the facilities team deals with that.”
- Visitor management systems: sign-in tablets and kiosks hold personal data (names, car registrations, photos, host details) and are usually internet-connected, but rarely get the same scrutiny as a staff laptop.
None of these sit neatly under “IT support” in most schools, they’re often supplied, installed, and maintained by a facilities contractor or a specialist third party, which is exactly why they’re the easiest things to leave off the register entirely. If it’s networked and nobody in IT support has ever logged into it, that’s worth finding out before it becomes the thing an attacker finds first.
Further resources
- NCSC’s Asset Management guidance (part of its 10 Steps to Cyber Security)
- DPE’s Digital Standards Tracker, for assessing progress against the DfE standards
- DPE’s Cyber Security Best Practice Area for micro-learning, guidance, and policies