Cyber security policies and procedures set out clear rules, guidelines and processes for how information is handled across your school or trust. Done well, they're not a compliance exercise, they're the blueprint that reduces human error and makes accountability possible, because everyone knows what's expected before something goes wrong, not after.

Recommended Policies

• Acceptable Use Policy (AUP):  what staff and pupils can and can't do with IT resources: internet, email, devices. DPE Customers can access our Acceptable Use Policy Template. You should also consider acceptable use policies for both students (usually secondary) and volunteers if they have access to devices and/or the internet.
• Password Policy: length, complexity, change frequency, and MFA requirements. DPE customers can review our Password learning nugget.
• Data Handling Policy: storage, transmission, access, and disposal rules for different categories of data. Review our FREE Records Management Toolkit.
• Remote Work Policy: security expectations for anyone working from home or off-site. DPE customers can review our working from home learning nugget and template policies.
• Incident Response Plan: roles, communication protocols, and steps to follow after a breach (covered in detail on Days 9 and 11). Check to see whether the relevant staff know how to access this plan.
• Access Control Policy: who can access what, built on least-privilege principles.
• Software Installation Policy: what staff may and may not install on school devices. 
• Mobile Device Policy: security requirements for smartphones and tablets used for work.
• Physical Security Policy: protecting physical assets from unauthorised access. Consider our Making the Rounds service to help you review your physical data security.

A quick self-check worth running: do you have a Business Continuity and Cyber Incident Plan? Do staff actually know what to do if something happens? Do you have written policies for access control, remote/mobile working, acceptable use, equipment loans, passwords, and removable media? If any of those are "no" or "not sure," that's your starting point.

How this maps to the DfE Cyber Security Framework

The DfE's Digital and Technology Standards set out expectations schools and colleges should meet by 2030, built around seven core areas:

1. Annual cyber risk assessments, with termly reviews
2. Cyber awareness initiatives for both staff and students
3. Anti-malware protection and firewalls
4. User account and access management
5. Keeping digital systems current and properly licensed
6. Backup procedures, reviewed annually
7. Incident reporting protocols

This is framed as the DfE's recommended approach to meeting the statutory safeguarding expectations under Keeping Children Safe in Education (KCSIE);  it isn't a certified, pass/fail scheme in itself. That said, within the framework, specific requirements carry genuinely mandatory weight, and the most recent updates have tightened exactly those points.

What's changed recently

The DfE updated the Cyber Security standard in June 2026, following an earlier change in April 2026. Together, these are worth knowing in detail:

• MFA scope has expanded substantially. Previously, MFA was expected mainly for senior leaders and staff accessing confidential, financial, or sensitive personal data. As of June 2026, it covers all staff accounts with access to cloud services or on-site systems, and all IT administrative accounts,  a much wider net. Passkeys are explicitly mentioned as an acceptable alternative on dedicated devices, tying back to Day 13's coverage of the NCSC's shift toward recommending them. Where MFA genuinely isn't available, stronger passwords are the fallback.
• Patching now has a mandatory 14-day window for high-risk vulnerabilities, introduced in the April 2026 update.
• IoT devices are now explicitly included in device management and firewall requirements,  this is a clarification of scope rather than a brand-new obligation.
• The standard now aligns with Cyber Essentials 2026. Worth noting: Cyber Essentials certification itself remains mandatory for colleges, but is not mandatory for schools, so a school adopting Cyber Essentials-aligned controls is following good practice, not meeting a certification requirement it's bound by.

Keeping track of where you stand

DPE's own DfE Cyber Security Tracker is built for exactly this: a self-assessment tool to check your position against the standards, rather than relying on memory or assumption. Given how much the MFA scope alone has moved this year, it's worth re-running that check now rather than assuming last year's answer still holds.

💡Your Daily Cyber Tip

Pick one policy from the list above that doesn't exist yet, or hasn't been reviewed in over a year, and put a date on your Day 10 risk register to fix it this term.

Where this sits in the DfE Digital & Technology Standards

This article is the DfE framework overview,  it sits across Cyber Security and Digital Leadership & Governance, and connects directly to the Role of Governors in Cyber Security and Data Protection for board-level accountability.

Further reading from DPE

• DfE Cyber Security Standards for Schools: June 2026 Update
• Update to the DfE Digital Cyber Security Standards (May)
• DfE Digital Standards Autumn Update
• The Role of Governors in Cyber Security and Data Protection