Filtering and monitoring sit either side of the same boundary. Filtering is preventative, it stops users reaching illegal, inappropriate, or harmful content before they ever see it. Monitoring is reactive, it watches what's actually happening on your network and devices, so concerning activity doesn't go unnoticed. Together, they're one of the few controls that serve both cyber security and child safeguarding at once.

How filtering works

• Email filtering blocks spam, phishing, and malware-laden messages before they reach an inbox.
• Web content filtering blocks access to malicious or inappropriate sites.
• Firewall filtering examines network traffic against defined rules (see Day 17 for the detail on this).
• DNS filtering blocks malicious domains before a connection is even established.

How monitoring works

• System logs flag anomalies across operating systems and applications.
• Network traffic monitoring spots unusual patterns, including possible data exfiltration.
• User activity monitoring tracks privileged account actions to catch insider misuse.
• SIEM systems centralise log collection and analysis.
• Endpoint detection and response (EDR) watches individual devices for malicious behaviour.

What the DfE Digital and Technology Standards say about this specifically

This article sits under the Filtering and Monitoring: Core Standard, which is detailed and leaves little to interpretation:

• Filtering must block illegal, terrorist, and adult content using Internet Watch Foundation and Counter-Terrorism Internet Referral Unit blocklists, and must apply to every device: school-managed, BYOD, and guest internet access alike. VPN and proxy bypass attempts should be blocked at the system level, and unmanaged (BYOD/guest) devices should sit on a separate virtual network, directly reinforcing the guest segregation covered on Day 17.
• Monitoring must go beyond in-person supervision where risk warrants it, with weekly reporting as a minimum and immediate alerts for high-risk incidents.
• Responsibilities are explicitly split: SLT scope and procure systems and document policy decisions; the Designated Safeguarding Lead reviews reports and responds to concerns; IT support maintains the systems; governors hold overall strategic accountability.
• A full review is required at least once every academic year, and immediately if a safeguarding risk emerges, working practices change, or, notably since the June 2026 update,  a new AI tool is introduced.

This is also the standard most directly tied to safeguarding law: KCSIE requires effective filtering and monitoring as a leadership responsibility, not just an IT task, with the DSL expected to be actively involved in decisions about what gets blocked and escalated.

The AI-shaped gap

The June 2026 update to this standard specifically addresses generative AI: filtering now needs to cover AI-generated content, and bringing in any new AI tool triggers an out-of-cycle review rather than waiting for the annual one. If your filtering provider can't yet detect AI-generated material, that's a live gap worth raising with them now.

💡Your Daily Cyber Tip

Take a quick look at your email's spam or junk folder today. If there's anything in there that looks like a genuine phishing attempt rather than ordinary spam, report it properly rather than just deleting it, then empty the folder.

More from DPE

• Read our full DSL's Guide to Filtering and Monitoring for the data protection side of this: DPIAs, privacy notices, and supplier due diligence