This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we're taking a different angle. Cyber security in a school or trust isn't a job for one person or one department; it's a set of responsibilities spread across several roles, each with a different part to play.

So this week, instead of career pathways, we're looking at who already holds a piece of cyber security in their day-to-day role:  from the Headteacher or CEO, through the Data Governance Lead and DPO, to IT support and governors, and what each of them actually needs to be doing.

Two very different jobs, one shared outcome

Today we're looking at the two ends of the spectrum: the CEO or Trust Board, who may never touch a server, and IT support,  Technician Dave, for short, though he could be anyone, in-house or outsourced, who touches them every day. Neither does the other's job. Both are accountable for the same outcome.

What a day looks like for the CEO / Trust Board

The NCSC's own Cyber Security Toolkit for Boards is blunt about this: "ultimate accountability to the shareholders is with the Board", and for a MAT, that's the CEO and Trustees. In practice, a CEO's "cyber day" isn't technical at all. It looks like:

• Treating cyber risk as a standing item in strategic planning, not a once-a-year report that gets nodded through
• Being able to answer, without checking notes, "what are our critical systems, and what happens if we lose them?"
• Knowing the trust's risk appetite. What level of risk is genuinely acceptable, and what isn't
• Making sure supplier contracts carry minimum cyber security requirements, and that suppliers are actually checked against them
• Being able to describe their own role if an incident happens tomorrow, not just delegating and hoping

That last point matters more than it sounds. Our own guide to communicating during a cyber incident is direct about this: "as head of the organisation, it will likely be your responsibility for responding to a cyber incident." The NCSC even publishes guidance specifically titled for CEOs responding to cyber incidents, because when something happens, the board doesn't get to stay in the background.

What a day looks like for IT support (Technician Dave)

Dave's day is almost entirely technical, and almost entirely invisible when it's going well:

• Patching, monitoring, and keeping the firewall rules documented and reviewed (see Days 11 and 17)
• Responding to the small stuff: a suspicious email reported, a locked account, a device that needs isolation, before it becomes the big stuff
• Maintaining the asset register alongside the SLT Digital Lead
• Being the first call when something goes wrong, and the first to know whether it's contained or spreading

Per the IT Support: Core Standard covered on Day 19, Dave (or his outsourced equivalent) is expected to hold genuine qualifications and experience for this, not just "good with computers." If he's external, Cyber Essentials accreditation is the expected baseline.

Where the two days meet

Neither the CEO's day nor Dave's day works without the other. A CEO who can't name the trust's critical systems can't make good investment decisions about protecting them. An IT lead with no board-level backing can flag a risk for years and never get the budget to fix it. The NCSC's board toolkit asks directly: "can every board member describe their role during a cyber crisis?" If the honest answer is no, that's not an IT gap, it's a leadership one.

The three systems question, and why the answers won’t match

Ask a CEO “what are our three most critical systems?” and ask Technician Dave the same question separately. They’ll likely give you different answers, and that gap is itself worth knowing about.

A CEO tends to think in terms of business impact: the MIS that holds every pupil record, the finance system that pays staff, the safeguarding database no one can afford to lose. IT tends to think in terms of infrastructure: the server those systems actually run on, the network that connects them, the email platform everything else depends on to function day to day.

Neither answer is wrong. But if the CEO has never had that conversation with IT, the trust’s actual priority list exists only in two different people’s heads, and they may not agree. Worth asking directly: where is this written down? Not “we’d know if asked” An actual document, reviewed and dated, that both the CEO and IT would sign off on as accurate right now. If there isn’t one, that’s a one-hour conversation worth having before you need it in a crisis, not during one.

💡Your Daily Cyber Tip

If you're a CEO or on a trust board, try answering this out loud today: "What are our three most critical systems, and what's our plan if we lose each one for 48 hours?" If you can't, that's this week's homework.

More from DPE

• See Day 19 for the full RACI breakdown of cyber roles across the organisation
• Read our guide to communicating during a cyber incident for what leadership needs to have ready before anything happens