This week, we’re using “Cyber Career Week”, the name the wider world already knows it by, to look at cyber security through the lens of who’s actually responsible for what in a school or trust. Not generic career-pathway content, but the real division of labour: what each role is accountable for, where the handoffs happen, and where things go wrong when nobody’s sure whose job it was.

The job governors actually have

Of everyone we’ve covered this week: the CEO, the headteacher, the Data Governance Lead and DPO, IT support, governors and trustees are the only ones the DfE’s own standard doesn’t ask to do anything technical. Their job is to support and challenge: to look at the digital technology strategy, the disaster recovery plan, the business continuity plan, and ask whether they stand up; not to write them, configure them, or run them.

That’s the “oversight without overreach” balance.  A governing body that never asks a single question about cyber risk has left a gap nobody else in the school is positioned to close.

What the DfE standard actually asks of governors

Under the Digital Leadership and Governance: Core Standard, governors or trustees:

• Support and challenge the school’s digital technology strategy: reviewing it, not writing it.
• Review, support, and challenge disaster recovery and business continuity plans, with sign-off where required.
• Should consider assigning a digital link role within the governing body. Someone who takes a closer interest and can bring informed challenge back to the full board. (The standard frames this as a recommendation, not a requirement — worth deciding deliberately rather than leaving unfilled by default.). We find sometimes this is also the data protection governor lead.

Where the DfE standard lacks guidance

It’s worth being honest about this: the standard doesn’t say how often governors should be updated, or exactly what “support and challenge” should look like in practice. That’s not a gap in this summary, it’s genuinely how specific the standard gets. Which is exactly why the NCSC’s own governor-facing guidance exists: to give that vague mandate some actual shape.

The NCSC’s eight questions

The NCSC and DfE jointly publish a short, deliberately non-technical set of questions for governing bodies, framed as a conversation starter, not a checklist to tick off:

1. Does the school have a list of its IT service providers?
2. Does the school leader know who manages or coordinates its IT?
3. Has the school identified its most critical digital services and sought assurance about their security?
4. Does the school have a backup and restoration plan, and does it actually practise restoring from backup?
5. Do governance and IT policies reflect the importance of good cyber security?
6. Does the school train staff on common threats like phishing?
7. Could the school keep operating if it lost access to its data or internet connection?
8. Does the school know who to contact if it suffers a cyber incident?

The NCSC’s wider advice for governors is just as practical: put cyber risk on the risk register alongside other risks, make it a standing board agenda item the same way GDPR already is, keep backups separate from the network, and hold an up-to-date contact list for IT suppliers, the local authority, the chair of governors, and law enforcement.

For trust boards: don’t assume the Cyber Governance Code of Practice isn’t for you

There’s a second piece of government guidance worth knowing about if you sit on a trust board rather than a single school’s governing body: the Cyber Governance Code of Practice. It’s written for boards of “medium and large organisations,” never mentions schools or trusts by name, and it’s easy to assume on that basis that it doesn’t apply.

Look at the actual thresholds behind that language, though. Under the Companies Act 2006 (as updated for financial years from April 2025), a medium-sized organisation has up to 250 employees and £54m turnover, above that, you’re “large.” Add up teaching and support staff across the schools in a multi-academy trust and a fair number of MATs clear 250 staff on headcount alone, putting them, by the government’s own measure, into large-organisation territory, whatever their accounts look like next to a commercial business. If that’s your trust, this Code is written for you, not around you.

Its five areas give a useful shape for board-level governance, and it’s explicit that it’s not meant for whoever handles cyber day to day:

• Risk management: identify and prioritise critical technology and services, assign senior ownership of cyber risk, assess supplier risk.
• Strategy: align cyber strategy with the organisation’s wider strategy and risk appetite.
• People: build a positive security culture with clear accountability, and measure whether training actually works.
• Incident planning, response and recovery: maintain and exercise an incident plan at least annually, including external stakeholders.
• Assurance and oversight: a governance structure with named executive and non-executive ownership, and formal reporting at least quarterly.

Some of the detail needs translating into school-sector language (there’s no CISO in most trusts), but the structure itself,  named ownership, regular reporting, supplier risk on the agenda,  translates well.

For a single school’s governing body, or a smaller trust well under that threshold, the NCSC’s own guidance for smaller organisations and the eight questions above remain the right starting point. One guidance document was explicitly ruled out for this piece: the NCSC’s Cyber Assessment Framework (CAF). It’s built for organisations formally designated as providers of “essential functions” under NIS-type regulation, and it’s a heavy, 41-outcome technical assessment tool, not something to hand to a governing body. Mentioning it here would risk the exact overreach this article is arguing against.

DPE customers can access a school/trust-friendly version of this framework under the Governance Best Practice Area.

Why this matters more this year: the Cyber Security and Resilience Bill

There’s a live reason to get this right now rather than next term. The Cyber Security and Resilience Bill is currently progressing through the House of Lords (Report stage, as of this October 2026, It hasn’t yet reached Royal Assent, so the detail could still change before it becomes law). Most schools and trusts won’t be directly designated under it. But the suppliers they depend on such as cloud platforms, MIS vendors, managed IT providers, are squarely in its sights, and the obligations on those suppliers are expected to flow down through contracts, procurement, and incident-reporting requirements.

For governors, that’s not a reason to start drafting technical policy. It’s a reason to ask question 3 above with real intent: has the school actually sought assurance from its critical suppliers, and would it know if one of them became newly regulated under this Bill? That’s oversight, not overreach , and it’s a question governors are specifically the right people to ask.

Where this sits in the Roles and Responsibilities picture

Using the structure from earlier in the series: governors are Informed on the technical detail, but Accountable (alongside the SLT digital lead) for making sure the strategy, disaster recovery plan, and supplier risk picture have actually been challenged, not just presented. They are not Responsible for any of the doing, that stays with IT support and the Data Governance Lead/DPO.

---

💡Daily Cyber Tip

Put the NCSC’s eight governor questions on the agenda for your next meeting, even just two or three of them. If nobody in the room can answer confidently, that’s the finding, not a failure.

---

You don’t have to start from a blank page

DPE’s The role of governors in cyber security and data protection, Cyber Responsibilities for Governors/Trustees in schools and Are Governors the Frontline of Cyber Security give governors something concrete to review rather than starting the conversation cold.