This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we're taking a different angle. Cyber security in a school or trust isn't a job for one person or one department; it's a set of responsibilities spread across several roles, each with a different part to play.
So this week, instead of career pathways, we're looking at who already holds a piece of cyber security in their day-to-day role: from the Headteacher or CEO, through the Data Governance Lead and DPO, to IT support and governors, and what each of them actually needs to be doing.
"It's an IT problem" is the most expensive sentence in cyber security
Ask most staff rooms who's responsible for cyber security, and the answer comes back fast: "IT." or "Dave". It's the single most common, and most costly, assumption in school cyber security, because it quietly lets everyone else off the hook. The DfE's own standards disagree, and so does every real incident DPE has worked through with schools: cyber security is a leadership responsibility first, a technical one second.
Who actually owns what
DPE's own RACI framework (first set out in our Cyber Responsibilities article) maps this out properly, but the short version:
- The SLT Digital Lead carries the heaviest accountability: owning outcomes across cyber risk, awareness, user accounts, backups, and attack response. That doesn't mean doing all the work personally; it means owning whether it got done.
- The Headteacher or CEO: holds specific accountability for cyber awareness and culture. As we've said before: training and culture aren't delegated away from leadership, however technical the subject feels.
- IT Support executes: the day-to-day technical work, and is consulted, not solely responsible, on awareness and culture initiatives.
- The DPO/data protection lead is consulted across nearly every area, reflecting how tightly cyber security and data protection are now wound together.
- Governors and trustees stay informed on risks and incidents, and are consulted on responsibilities . They are there to challenge plans, not rubber-stamp them.
- Every member of staff is "informed" on accounts and incidents. In practice means one job: report anything that looks wrong, immediately.
What the DfE Digital and Technology Standards say about this specifically
Two named standards sit behind this:
Digital Leadership and Governance: Core Standard: requires schools to establish a "clear definition of roles and responsibilities," with the Headteacher assigning an SLT Digital Lead (someone who "does not need to be an expert," but owns the strategy, the asset register, and disaster recovery planning), governors considering a digital link role to review and challenge plans, and named contributions from IT support, the DPO, and the DSL.
IT Support: Core Standard: requires that the IT team or provider has "the necessary qualifications and experience to understand the standards," with external providers expected to hold Cyber Essentials accreditation, and ongoing training required to keep both technical and non-technical staff current. This is the standard that makes IT support a strategic voice, not just a reactive help desk.
You don't have to start from a blank page
We've already built tools for exactly this gap. Our "Have you assigned your SLT Digital Lead yet?" article walks through what the role actually involves: bridging IT, SLT, curriculum leads, the DPO, the DSL, and finance, and includes a quick self-check (Yes / No / Not sure) so you can see where your school stands in under a minute.
If you want a fuller picture of where your whole organisation sits against the DfE Digital and Technology Standards, not just the Digital Lead question, our DfE Digital Standards benchmarking quiz gives you a scored result across all 12 standards, including Digital Leadership and Governance.
Not sure who should be assigned the role? Review our SLT Digital Lead Profile article.
A note on who's actually behind this content
Several of DPE's own consultants hold IT and cyber security qualifications and hands-on experience, alongside their data protection expertise. We've worked in schools in trusts in IT and data protection roles.
💡Your Daily Cyber Tip
If you're not sure who your school's SLT Digital Lead is, that's this week's first job: find out, and make sure it's written down somewhere more permanent than someone's memory.
More from DPE
- Read the full Cyber Responsibilities RACI breakdown for every role in detail
- See our DfE IT Support Standards guide for what to expect from an in-house or outsourced IT team