News

Governing bodies have a strategic oversight of all of a school or trust's strategies, including cyber security and data protection.

🎄We've updated our end of term and end of year guidance, alongside advice for privacy considerations for special occasions (which also normally occur at the end of term, such as Christmas).

📢 It's important to be prepared for when a cyber incident happens to you.  Part of that preparation should include having a Cyber Incident Response Plan, and part of that plan should include how to communicate, who does the communication and what they should say.

📃 A digital technology contracts register is a lit of all the contracts in your organisation with external suppliers for the supply of digital technology products and services.

⚠️ On Friday 8th November South East Technological University (SETU) experienced a cyber security incident.

We are sharing some of blog posts by school ICT technicians and ICT managers that are giving their advice about keeping your school cyber secure and resilient.

🍂 The DfE have published several updates to the DfE Digital Standards, updating the Filtering and Monitoring Standards, the Digital Leadership & Governance Standards and the Broadband Internet Standards for Schools and Colleges. We give our view on what that means and more details about the updates.

🎦 CCTV systems play a critical role in maintaining safety and security in organisations.  In schools, for example, it might help deter inappropriate behaviour, prevent unauthorised access and damage to property.

📢 A special school in Devon has been the victim of a cyber attack and is being blackmailed by hackers.

In a Malwarebytes blog, author Mark Beare explains how your child's data can be stolen, and even more so if you have given medical  or health data.

🌑🗃️💻 Dark data is data that is unused but still might be stored somewhere in an organisation, usually kept in unstructured and unsecured repositories or storage.

While we are focusing on cyber security and cyber resilience in October, Ofqual is reminding schools and colleges of the importance of cyber security after a poll highlighted the risks associated with poor cyber hygiene.

We are often asked for advice on where to search for information and data when you receive an information request. The ICO has published a checklist with guidance.

Sadly, we are letting you know about another cyber attack on a group of schools in Blackpool in the second week of term.

📢 We would like to announce that Data Protection Education are sponsoring the data protection discussion forum with the Association of Network Managers in Education.

A high school in south London was closed for the first part of this term due to a ransomware attack.  Students were sent home advising parents that the school would be closed for three days while all staff devices were 'cleansed'.

Follow us on social media for the latest updates, exclusive content, and insights into data protection best practice, cyber security and online safety.

Another school has been hit by a cyber attack, this time in Canvey Island, Essex, who say the cyber attack happened during the summer holidays.

🛡️✅ Gone are the days when cyber security issues meant accidentally downloading a virus, it has grown to mean so much more, where data and identities are stolen, fraud is committed and businesses can be shut down from a cyber attack.  With that in mind we have created a cyber security best practice area to help guide and support your data protection compliance.

The data protection officer is mentioned many times in the DfE Digital Standards for Schools and Colleges as someone that should either be informed or consulted with.  As part of that consultation process, we would like to announce our new DfE Digital Standards for Schools and Colleges Tracker.

We are launching a new best practice area which has all the policies, documents and posters in one place.  You can find this page in our main best practice area:

We've put all the specific school and trust related data protection guides, documents and queries into one area to make it easier for you.

We recognised that a number of our customers needed a generic retention schedule to help get them started with their records management.

We've updated our 'Making the Rounds', data walk, to include some central processes that should be included in data protection and cyber security compliance:

An update this week from the ESFA has reported a change in requirements regarding IT security for colleges and special post-16 institutions (SPIs).

The ICO have issued a reprimand to a school that did not follow due diligence when introducing facial recognition technology (FRT).

The recent news has been full of the global IT outage that affected many systems over the weekend, including airlines and patient access.  Although the incident was not caused by a cyber attack, it is important to note that it was a cyber incident which affects everyone.

A cyber incident is an event with threatens the confidentiality, integrity or availability of information systems, networks or the information they contain.

Review our previous article: What's a Cyber Incident and what should we do?

Cyber incidents can be intentional or accidental and can cause major disruptions.  The recently reported CrowdStrike incident caused significant global disruption.  While there are huge impacts to the affected systems, for which there are now fixes available, there will be an aftermath of 'unrest' where threat actors will use people's vulnerability and concern to send phishing emails.

The NCSC has already reported an increased in phishing activity as opportunistic and malicious actors seek to take advantage of the situation.  The emails could be aimed at organisations or individuals.

The NCSC has released this guidance:

Organisations should review NCSC guidance to make sure that multi-layer phishing mitigations are in place, while individuals should be alert to suspicious emails or messages on this topic and know what to look for.

Their full report can be read here: NCSC Major IT Outage

We've made a short micro learning video for you to share with staff about how they might be affected by cyber incidents like this one:



View our other free micro learning videos!

Article images created using Microsoft Copilot AI.
Micro Learning video created using Vyond AI.

Plans for the new government to introduce legislation for cyber security, digital and data were outlined in the King's speech on 17 July 2024.

Ageing and out of date technology is an every day challenge for most schools and small businesses, but is there a risk?

We are asked a lot about retention schedules and keeping file when a pupil moves onto another school.  

---

This short video explains the basics behind data retention and the implications of keeping data for longer than required.



  Knowledge Bank
We have a retention schedule on our Knowledge Bank portal where you can check the retention period for all types of files in  your organisation.

Visit our Records Management Best Practice Library for more advice and policy templates.

Consider email data retention covered in this article:


Contact us at This email address is being protected from spambots. You need JavaScript enabled to view it. if you would like us to do a data retention workshop in your organisation.