This week is National Cyber Security Career Week,  and while most content for it focuses on getting new people into the profession, we’re taking a different angle. Cyber security in a school or trust isn’t a job for one person or one department; it’s a set of responsibilities spread across several roles, each with a different part to play.

So this week, instead of career pathways, we’re looking at who already holds a piece of cyber security in their day-to-day role, from the Headteacher or CEO, through the Data Governance Lead and DPO, to IT support and governors, and what each of them actually needs to be doing.

“Do I need to be an expert?” No. “Am I accountable anyway?” Yes.

The DfE’s own Digital Leadership and Governance: Core Standard gives Headteachers a surprisingly honest get-out clause: the Headteacher or Principal “does not need to be an expert” in digital technology. What they do need is to make sure the standard gets met, and that starts with one specific action.

The Headteacher’s actual job: appoint, then step back (but not away)

Per the standard, the Headteacher’s named responsibility is to appoint an SLT Digital Lead. That’s it, technically, the standard gives the Headteacher no explicit role in writing or reviewing the digital technology strategy itself. That work belongs to the person they appoint.

But “appoint and step back” isn’t the same as “appoint and disappear.” DPE’s own RACI breakdown (from Cyber Responsibilities) is specific about where the Headteacher stays genuinely on the hook:

• Accountable for cyber awareness: training and culture aren’t delegated away from leadership, however technical the subject feels
• Consulted on cyber risk: input before decisions, not just told afterwards
• Informed on user accounts & access, and on cyber attacks if one happens

So “not an expert” doesn’t mean “not involved.” It means the Headteacher owns the culture and the awareness piece directly, gets a say on risk, and stays in the loop on everything else.

The SLT Digital Lead does the heavy lifting with real requirements attached

Once appointed, the SLT Digital Lead is accountable for the strategy itself, and the standard is specific about what that involves:

• Understanding the school’s development plan, and building the digital technology strategy to support it. The standard’s own wording is that the strategy should align “in line with your school’s or college’s development plan,” with the vision supporting “the school or college’s development plan and educational vision”
• Writing a strategy that covers a minimum of two years
• Reviewing it at least annually
• Sharing a top-level summary with key stakeholders, not keeping it in a drawer
• Being accountable for “the delivery of the digital technology strategy based on teaching and learning outcomes and organisational needs”

Worth flagging precisely, since it’s easy to assume more alignment is required than actually is: the standard ties the digital strategy to the development plan specifically, it doesn’t name the school improvement plan, and it doesn’t require formal alignment with the safeguarding policy or other named strategies. The DSL is consulted for advice on risks relevant to their role, and a trust IT director is consulted to align with the digital strategy, but that’s input, not a mandated cross-document alignment exercise. Don’t build more process than the standard actually asks for.

Can the Headteacher just appoint themselves?

The standard doesn’t say either way,  it’s silent on whether the Headteacher can hold the SLT Digital Lead role personally rather than assigning it to someone else. In a small primary with a thin SLT, this often isn’t a choice so much as the only realistic option, and nothing in the standard rules it out.

Worth thinking through before defaulting to it, though:

• It’s legal, but it concentrates risk. If the Headteacher holds both the “appoint and oversee” role and the “do the work” role, there’s no one left to challenge their own strategy, their own review timing, or their own blind spots. The standard’s separation of Headteacher and SLT Digital Lead exists partly so someone else is accountable for the detail; self-appointing collapses that back into one person.
• Succession becomes a single point of failure. If the Head leaves and no one else has ever owned the digital strategy, the next Head starts from zero, with no handover and no institutional memory of why decisions were made.
• Time is the real constraint, not expertise. The standard is explicit that the role “does not need to be an expert”, so the usual objection (“I’m not technical enough”) isn’t really the blocker. The blocker is that a Headteacher already has very little room for a two-year strategy, annual reviews, and ongoing oversight on top of everything else on their desk.
• If it’s the only option, build in the check that’s missing. Ask governors to take the digital link role seriously and genuinely challenge the strategy, rather than nodding it through, that’s the substitute for the internal challenge a separate Digital Lead would normally provide.

If there’s any way to appoint someone else, even someone without a lot of spare capacity, that separation is worth protecting. If there genuinely isn’t, know what you’ve traded away, and compensate for it through governors rather than letting it go unchecked.

Where governors come in

Governors and trustees support and challenge the strategy from the outside, and the standard suggests they consider assigning a digital link role: someone on the board who engages with this specifically, rather than leaving digital strategy as one line in a termly report nobody has time to scrutinise. 

💡Your Daily Cyber Tip

If you’re a Headteacher, check one thing today: has your SLT Digital Lead’s strategy actually been reviewed in the last 12 months, and have you, and your governors, seen the top-level summary? If not, that’s this week’s action.

More from DPE

• Read the full Cyber Responsibilities RACI breakdown for every role
• See our “Have you assigned your SLT Digital Lead yet?” self-check if that appointment hasn’t happened yet
• See Day 19 for the wider roles overview, and Day 20 for how this connects to the CEO/Trust Board level in a MAT