An editable checklist for working through the DfE's seven cyber security standards for schools and colleges with your SLT digital lead, IT support, DPO and governors. 2026/27 edition, checked against the standard as updated on 16 September 2026, including the June 2026 changes to align with the NCSC's Cyber Essentials 2026.
What's new in this edition
- Requirements that are new or stricter since our May 2024 version are clearly marked, including unique credentials for every user, MFA on all staff cloud and remote-access accounts and all IT admin accounts, and fixing serious vulnerabilities within 14 days
- Vulnerability fixes now include configuration or registry changes and vendor scripts, not only patches
- Internet of things devices, secure development of commissioned apps, Report Fraud (formerly Action Fraud) and the DfE Cyber Security Hub
- The September 2026 link to your statutory duty under Keeping children safe in education
What's inside
- A one-page summary of what's changed since 2024
- All seven standards as tick-and-evidence tables: risk assessment, cyber awareness, firewalls and anti-malware, user accounts and access, licensing and updates, backups, and reporting attacks
- For every line: whether you meet it now, your evidence, or the next step and who owns it
- Who needs to be involved and when each standard should be met
- Current position, target and evidence boxes for each standard, and a sign-off table
Editable Word document, 12 pages, landscape. Useful for asking an outsourced IT provider to show how they meet each requirement, and for working towards Cyber Essentials.
Part of the HeadteacherChat community library. Members get this resource, the full topic pack it belongs to and every update when guidance changes, alongside live sessions and more than 1,400 fellow school leaders. Join the community.
