The NCSC advises: "there's no way to completely protect your organisation against malware infection." That's not a reason to give up, it's the reason defence-in-depth exists. Instead of relying on one control to stop everything, you build multiple layers, so that if one fails, the next one catches it, and if an attacker does get in, the damage is contained and recovery is fast.

Following the real attack on Shottermill Junior School covered on Day 11, here's how that layered defence actually looks in practice, updated against the NCSC's current guidance on mitigating malware and ransomware attacks, and the ICO's guidance on ransomware and data protection compliance.

Layer 1: Backups that actually work when you need them

The NCSC is direct about this: up-to-date backups are the most effective way of recovering from a ransomware attack. Follow the 3-2-1 rule: three copies of your data, across two different storage types, with one copy offline or air-gapped.

• Keep at least one backup disconnected from your network; a backup reachable from your main systems isn't a backup, it's another target, as Day 11 covered
• Use more than one backup solution where possible
• Test restoration regularly. A backup you've never tried to restore from is a hope, not a plan

Layer 2: Prevent delivery and spread

Most ransomware still arrives through phishing, so this layer is about stopping it before it lands and limiting how far it can travel if it does:

• Mail filtering and web content inspection to block known malicious sites
• Disable unnecessary remote access protocols like RDP where not in active, controlled use
• Enforce MFA at every entry point: remote access, cloud services, and privileged accounts especially
• Restrict user permissions under the principle of least privilege, so a compromised account can't move freely across your network
• Network segmentation: separate guest and student networks from sensitive systems and staff resources

Layer 3: Prevent execution

If something malicious does arrive, this layer stops it from running:

• Application whitelisting, so only approved software can execute
• Keep antivirus and endpoint detection and response (EDR) tools current with the latest definitions
• Constrain scripting environments and macros, a common route for malware to execute undetected
• Patch management: the NCSC and ICO both prioritise patching critical vulnerabilities fast. This connects directly to the DfE guidance covered on Day 11, which states patches for critical/high-risk vulnerabilities must be applied within 14 days
• Remove or isolate devices running outdated, unsupported software: attackers specifically target known, unpatched vulnerabilities

Layer 4: Staff awareness — your human firewall

Technology alone doesn't stop ransomware. Staff who can recognise a phishing attempt, a suspicious link, or a request that doesn't feel right are often the layer that catches what everything else missed. Annual training is the DfE's minimum expectation, but as covered on Day 9, the goal is a culture where people report immediately, not just a training record that ticks a box.

Layer 5: Be ready before you need to be

Having a plan matters as much as having controls. The NCSC recommends:

• Identifying your critical assets in advance, so you know what to protect first
• A documented incident response plan with a clear communications strategy
• Deciding your ransom policy before an incident, not during one
• Regularly exercising the plan through tabletop drills, as covered on Day 10's risk register and action plan guidance

What not to do: paying the ransom

Both the NCSC and the ICO are explicit on this point. The ICO states that paying a ransom is not an "appropriate measure" under UK GDPR and does not count as effective risk mitigation, payment provides no guarantee of decryption or that stolen data won't be published anyway. The NCSC points to the No More Ransom Project as a resource for free decryption tools where available, and recommends reporting incidents directly to the NCSC at report.ncsc.gov.uk.

Your reporting obligations haven't gone away

A ransomware attack that blocks access to personal data is a personal data breach under UK GDPR, even without evidence of theft;  loss of timely access counts. The ICO's standard 72-hour notification clock applies, as covered in detail on Day 9.

💡Your Daily Cyber Tip

Pick one layer above you're weakest on: most schools' answer is backups that aren't actually tested, or MFA that isn't enforced everywhere it should be. Make it this month's priority action on your Day 10 risk register.

Further reading from DPE

• Ransomware, Extortion and the Cyber Crime Ecosystem: how Ransomware-as-a-Service has lowered the barrier to entry for attackers 
• World Backup Day: Backups – Your Safety Net
• Be Cyber Aware: Firewalls
• VICE SOCIETY: Ransomware Attacks on Schools

Where this sits in the DfE Digital & Technology Standards

This sits under Cyber Security, drawing together MFA, patching, and backup requirements covered on Day 11, and reinforces Digital Leadership & Governance's expectation of board-level ownership of cyber resilience.