This week, we’re using “Cyber Career Week”, the name the wider world already knows it by, to look at cyber security through the lens of who’s actually responsible for what in a school or trust. Not generic career-pathway content, but the real division of labour: what each role is accountable for, where the handoffs happen, and where things go wrong when nobody’s sure whose job it was.
This week, we’re using “Cyber Career Week”, the name the wider world already knows it by, to look at cyber security through the lens of who’s actually responsible for what in a school or trust. Not generic career-pathway content, but the real division of labour: what each role is accountable for, where the handoffs happen, and where things go wrong when nobody’s sure whose job it was.
This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we’re taking a different angle. Cyber security in a school or trust isn’t a job for one person or one department; it’s a set of responsibilities spread across several roles, each with a different part to play.
This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we’re taking a different angle. Cyber security in a school or trust isn’t a job for one person or one department; it’s a set of responsibilities spread across several roles, each with a different part to play.
This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we're taking a different angle. Cyber security in a school or trust isn't a job for one person or one department; it's a set of responsibilities spread across several roles, each with a different part to play.
This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we're taking a different angle. Cyber security in a school or trust isn't a job for one person or one department; it's a set of responsibilities spread across several roles, each with a different part to play.
Filtering and monitoring sit either side of the same boundary. Filtering is preventative, it stops users reaching illegal, inappropriate, or harmful content before they ever see it. Monitoring is reactive, it watches what's actually happening on your network and devices, so concerning activity doesn't go unnoticed. Together, they're one of the few controls that serve both cyber security and child safeguarding at once.
Day 16 looked at access control from the outside in: securing the connection when staff work beyond school walls. Today we go back to the perimeter itself: the firewall every one of those connections has to pass through, and the network behind it. A firewall that's switched on but never reviewed, or a network where one device can talk to everything else, undoes a lot of the good work covered so far this month. Perimeter and gateway security is less glamorous than ransomware or phishing, but it's the layer that decides whether an intrusion stays contained or spreads.
Cyber Security Awareness Month has spent the last two days on who has access and how it's controlled inside your school's own walls. But for most schools and trusts today, "inside the walls" is only part of the picture. Staff mark books at home, SLT reply to emails on the train, and admin teams log into finance systems from a kitchen table. Remote working isn't an edge case anymore; it's routine. Which means access control has to work just as hard outside the building as it does inside it.
Every attacker chasing a school network has the same goal once they're in: find an account with more power than it needs. A compromised standard user account is a nuisance. A compromised admin account is a takeover, it can touch every system, every dataset, and every piece of security infrastructure built to stop exactly this. It can probably reset passwords.
On 14 October 2026 the Department for Education (DfE) replaced the Data (Use and Access) Act chapter of its Data protection in schools guidance with a new, practical DUAA compliance checklist for schools. The previous chapter told schools to review their procedures and promised more information "in due course". This is that information: eight themed checklists setting out what changed and what schools are expected to do about it.
Cyber security policies and procedures set out clear rules, guidelines and processes for how information is handled across your school or trust. Done well, they're not a compliance exercise, they're the blueprint that reduces human error and makes accountability possible, because everyone knows what's expected before something goes wrong, not after.
Over the past two weeks, we've covered how attackers get in: phishing, deepfakes, ransomware, and what to do when they do. Access control is about the layer that decides whether any of that actually works: even a perfectly crafted phishing email or a stolen password is useless to an attacker if the account behind it is properly protected. Today we look at the single most effective access control measure available, where it still falls short, and what's changing.
The NCSC advises: "there's no way to completely protect your organisation against malware infection." That's not a reason to give up, it's the reason defence-in-depth exists. Instead of relying on one control to stop everything, you build multiple layers, so that if one fails, the next one catches it, and if an attacker does get in, the damage is contained and recovery is fast.
Ransomware headlines tend to focus on big retailers, hospitals, and government agencies. But schools and colleges are an escalating, and in some ways more vulnerable, target, and a recent case shows exactly how indiscriminate the threat is.
A well thought-out plan gives you a structured approach to improving your security posture, identifying weaknesses, and ensuring a rapid response when an incident occurs. The goal is moving from reactive panic to proactive preparedness, and that starts with understanding exactly where you stand today, before building the plan and risk register that gets you further.
Across this series we've covered voice cloning, synthetic video, and AI-crafted phishing, three ways attackers are getting better at looking legitimate. But there's a quieter problem that does just as much damage: people notice something's wrong, and don't say anything.
Phishing remains one of the most prevalent and effective cyberattack methods, tricking millions into compromising their data every year. These deceptive messages, often arriving via email, text message (smishing), or phone call (vishing), are designed to look legitimate. They aim to trick you into revealing sensitive information like login credentials, credit card numbers, or personal data, or to click on malicious links that install malware. They may also be the start of a more complex cyber attack as a way into a system.
Yesterday we looked at voice cloning. Today's threat is more visually convincing : synthetic video. AI-generated footage that can show someone saying or doing something they never did, sometimes convincingly enough to fool the naked eye in real time.
This week, we're turning our Cyber Security Awareness Month series toward one of the fastest-growing threats facing schools and trusts: AI-generated deepfakes, starting with audio and voice cloning scams.
Cyber security can look like an IT problem, something for someone else to handle. It isn't. DPE has created as set of resources as a starting point to help you work out, role by role, who is accountable, who does the work, who should be consulted, and who just needs to be kept informed. Almost everyone in a trust or school appears somewhere on that list. That's the whole idea behind this year's theme: don't make it easy for them. Attackers rely on someone assuming it's not their job.
Whether your school's data lives in a server cupboard down the corridor or in the cloud, the same question applies: is it protected from unauthorised access, corruption or theft, throughout its whole lifecycle? Data security combines physical, technical and administrative safeguards, and getting all three right matters more as schools move more of their data off-site.
Cyber security and data protection sit side by side. Cyber security protects the systems; data protection governs what happens to the personal data inside them. In a school, that data is mostly about children, so the stakes are higher than in most sectors.
Yesterday we looked at why cyber security matters. Today we look at the people who protect personal data every day, and why an annual training module on its own rarely changes what they do.
October is Cyber Security Awareness Month, and this year's theme is "Don't Make It Easy for Them".
We don't think cyber security awareness is something to cover just once a year, but this month gives us a focus. Every day in October we'll share a short topic and one practical action you can take straight away.
Bromcom, one of the most widely used MIS providers in England, has confirmed a personal data breach affecting a legacy single sign-on (SSO) registration service. Bromcom is now contacting affected schools and trusts directly. If you use Bromcom, this article explains what we know so far, what you need to decide as a data controller, and the practical steps that reduce your risk, both from this incident and the next one.
On 30th September 2026, the Information Commissioner's Office formally became the Information Commission under the Data (Use and Access) Act 2025. The Commission is now run by a Board rather than a single Commissioner, but it will still be known as the ICO.
Handling Subject Access Requests (SARs) (Knowledge Bank subscribers) involving pupils is rarely straightforward. A recent helpdesk scenario put a school in a particularly difficult position: a 14-year-old pupil disclosed that her parents had pressured her into signing a form authorising them to request her personal records.
Annual data protection training works well for core staff, but it often misses the people who arrive at short notice or whose roles don't look like "data" jobs: supply teachers, cleaners, caretakers and contractors. These staff still see personal data every day, and they share their own with your organisation too. Our new training pack is built for them, including a free Quick Guide for Emergency & Supply Teaching Staff developed with Garth Hill College.
Most organisations will ask us to come and do a data walk at some point, when one of our consultants will visit your site and walk around with your data protection lead. If you are a DPO Assure customer, it is included as part of your SLA, but it is also possible to purchase a visit from one of our school consultants.
Understanding "making the rounds" audits, the 12-point compliance framework, and what schools should expect from a report
©2026 Data Protection Education Ltd.