This week, we’re using “Cyber Career Week”, the name the wider world already knows it by, to look at cyber security through the lens of who’s actually responsible for what in a school or trust. Not generic career-pathway content, but the real division of labour: what each role is accountable for, where the handoffs happen, and where things go wrong when nobody’s sure whose job it was.

The engine room nobody sees running

Every school has a version of Technician Dave. He gets the 8:15am call because the MIS “isn’t working,” he’s three tickets deep before the first bell, and he’s somehow also the person patching servers at 6pm because nobody else can. IT support is where cyber security either gets done properly or quietly doesn’t, and most of the school never sees which, because the only time anyone notices IT support is when something’s broken.

That’s the problem with treating IT support as “the technical bit.” It isn’t a bit. It’s the function that makes most of a school’s other cyber obligations physically possible to meet.

What the DfE IT Support Standard actually asks for

The DfE’s IT Support standard, one of the wider digital and technology standards that supports the six core ones, sets out the full scope of the job: keeping registers of every asset, system and contract; applying security patches and firmware updates; managing backups and disaster recovery; agreeing response times and escalation routes with the SLT digital lead; running an annual review of whether the support arrangement is actually working; and training staff on the essentials. It explicitly covers in-house, outsourced and hybrid support.

Where the detail gets specific: the Cyber Security Core Standard

This is where “how fast is fast enough” stops being a guess:

• Critical or high-severity vulnerabilities (CVSS score 7.0 or above) must be patched within 14 days of release; DfE-flagged security updates within 5 working days. If a patch isn’t available yet, the standard expects the device to be isolated from the network, not left exposed.
• Multi-factor authentication is required on every staff account accessing cloud services or remote systems, and on all IT admin accounts: no exceptions.
• Backups follow the 3-2-1 rule: three copies, two devices, one off-site, must be immutable, and are tested termly, not whenever someone remembers.
• Firewall rules are documented, reviewed termly, and signed off by the SLT digital lead, with default admin passwords changed and remote admin access restricted.
• Admin accounts are separate from day-to-day accounts, and privilege changes need sign-off from an SLT member or trustee. IT support shouldn’t be the only person who can grant themselves more access.

The Filtering and Monitoring Core Standard sits right alongside this: IT support is expected to work with the designated safeguarding lead on filtering decisions, and to actively monitor firewall and anti-malware logs — not just install the tools and assume they’re working.

Who’s accountable for what

Using the RACI structure from earlier in this series: IT support is almost always Responsible for doing the technical work i.e. patching, MFA, backups, firewall configuration. The SLT digital lead is Accountable for the outcome and signs off decisions IT support can’t make alone. The DPO is Consulted wherever the work touches personal data, backup locations, access reviews, incident response. Governors or trustees are Informed, especially once something needs reporting externally.

That escalation chain matters more than it sounds. Anyone can report a suspected incident to IT support, but it’s the SLT digital lead, not IT support, who decides whether that incident goes to the NCSC, the ICO, Report Fraud, or the DfE’s sector cyber team, and within what timeframe.

💡Daily Cyber Tip

Ask your IT support (internal or outsourced) four quick questions: What’s our current patch backlog, and is anything on it critical? Is MFA on for every admin account? When did we last test a backup restore? When were our firewall rules last reviewed and signed off? If any answer is “not sure,” that’s where to start.

You don’t have to start from a blank page

DPE’s SLT Digital Lead self-check and DfE Standards benchmarking quiz will tell you fairly quickly whether your IT support function is set up to meet these expectations,  or whether Technician Dave is quietly carrying more than any one person was ever meant to carry.