School IT Support and the DfE Digital and Technology Standards: A 2026 Guide

The short answer: The Department for Education expects every school and college to meet six core digital and technology standards by 2030: broadband internet, wireless network, network switching, digital leadership and governance, filtering and monitoring, and cyber security. Most of the cyber security and filtering requirements apply now, not in 2030. Few schools have the in-house staff to meet them all, which is why many use outsourced school IT support, either fully or alongside an on-site technician. If you are choosing a provider, our IT support for schools page sets out what we do and what it costs.

Last updated: 29 September 2026. Checked against the DfE’s digital and technology standards guidance and the Cyber Security Breaches Survey 2025/2026 on that date.

In this guide

• The six core standards
• What the cyber security standard requires
• RPA cyber cover conditions for academies
• Filtering, monitoring and KCSIE 2026
• The DfE’s standard for IT support
• In-house technician, outsourced or both?
• Choosing a school IT support provider
• Frequently asked questions

What are the DfE’s core digital and technology standards?

The DfE’s guidance, Meeting digital and technology standards in schools and colleges, says all schools and colleges should be working towards six core standards by 2030. The timing is set requirement by requirement, and several parts apply now:

Core standard	What it covers	When
Broadband internet	Full fibre connection, a backup connection, security and safeguarding	Security now; full fibre as soon as you can
Wireless network	Wi-Fi that covers teaching spaces and supports current standards	When you next upgrade an underperforming or unsupported network
Network switching	Core switches, including connection to an uninterruptible power supply	When you next replace switching
Digital leadership and governance	A senior leader responsible for digital, asset registers, digital in continuity plans, an annual digital strategy	Registers and continuity plans now
Filtering and monitoring	Blocking harmful content and monitoring activity, with named roles and annual review	Now
Cyber security	Risk assessment, training, protection, access control, updates, backups and incident reporting	Now; backups must be in place immediately

The DfE also publishes further standards for cloud solutions, digital accessibility, IT support, devices, network cabling, and servers and storage.

What does the cyber security standard require?

The cyber security core standard is the most demanding, and it applies now. Its requirements cover seven areas:

1. Risk assessment carried out annually and reviewed every term.
2. A cyber awareness plan for staff and students, with training at least annually.
3. Anti-malware and firewalls protecting digital technology and data.
4. Controlled user accounts: multi-factor authentication must be enabled for all staff accounts with access to cloud services or remote access to on-site systems, and for all IT administrator accounts.
5. Licensed, up-to-date technology: critical or high-risk vulnerabilities (CVSS 7.0 or above) fixed within 14 days.
6. Backups: at least three copies of your data, two on separate devices and one offsite. Backups must be immutable, meaning they cannot be changed once created, and tested every term or after significant changes.
7. Reporting cyber attacks to your insurer or the RPA, to Report Fraud (formerly Action Fraud), and to the DfE’s sector cyber team, with the ICO also informed of serious personal data breaches.

Cyber Essentials is a funding requirement for colleges. For schools it is optional, but the DfE notes that meeting the standards helps you work towards it.

The threat is real and rising. The government’s Cyber Security Breaches Survey 2025/2026 found that 49% of primary schools and 73% of secondary schools identified a breach or attack in the previous 12 months, compared with 43% of businesses. The secondary figure was up from 60% the year before.

What are the RPA cyber cover conditions for academies?

Academies and other schools in the DfE’s Risk Protection Arrangement (RPA) have cyber cover, but only if they meet its conditions. The DfE’s Cyber Security Hub lists four:

• Keep offline backups of your data.
• Staff and governors with access to the school’s IT complete the free NCSC cyber security training for schools, and you can evidence it annually.
• Register with Police CyberAlarm.
• Have a cyber response plan in place.

If one of these is missing when an incident happens, the school may find it is not covered. They are worth checking with your IT provider now rather than after an attack.

How do filtering and monitoring relate to KCSIE 2026?

The filtering and monitoring standard asks schools to assign clear roles, review provision at least annually, block harmful and inappropriate content without unreasonably restricting teaching, and monitor activity effectively. Every part applies now, and the guidance now also points schools to the DfE’s standards for generative AI products.

The DfE describes these standards as its recommended approach to meeting the online safety duties in Keeping Children Safe in Education. The 2026 edition came into force on 1 September 2026 and replaces KCSIE 2025, so policies and IT settings written against the old version should be reviewed.

What does the DfE say about IT support?

The DfE has a standard specifically for IT support, whether it is in-house or outsourced. It says IT support should:

• Help you meet the digital and technology standards.
• Actively maintain and improve your technology in line with your digital strategy.
• Be responsive and meet agreed service expectations.
• Be reviewed at least once a year.
• Make sure staff get clear guidance and training on the technology they use.

The guidance also makes a point worth remembering at contract time: value for money does not necessarily mean the lowest cost. It suggests considering credentials such as Cyber Essentials certification when choosing a provider.

Should a school use an in-house technician, outsourced support or both?

Each model has a place. The right one depends on the size of the school and what you already have:

Model	Strengths	Weaknesses	Often suits
In-house technician	On site every day, knows staff and rooms	One person cannot cover every standard; no cover for absence	Larger secondaries, alongside specialist support
Fully outsourced	Breadth of skills, tools, security expertise, cover built in	Needs good scheduling for on-site time	Primaries and small schools
Hybrid (technician plus provider)	Daily presence plus specialist back-up, monitoring and security	Needs a clear split of responsibilities	Secondaries and multi-academy trusts

The government’s survey found 77% of primary schools and 54% of secondary schools already use an external cyber security provider. For many schools, the question is not whether to outsource but how much. Remote support now resolves most day-to-day issues quickly, so on-site visits can be kept for installations, hardware and network work. We compare the models more generally in IT outsourcing models explained.

How should a school choose an IT support provider?

Ask any provider to show how it will help you meet the standards, not just fix problems. In particular:

1. Can you map our current setup against the six core standards and give us a prioritised plan?
2. How will you evidence the cyber security standard: MFA, 14-day patching, backups and termly restore tests?
3. Are our backups immutable, and is one copy offline for RPA cover?
4. Who configures and reviews our filtering and monitoring, and how do you report to our designated safeguarding lead?
5. Are you Cyber Essentials certified?
6. What response times do you guarantee in writing, and how often will you be on site?
7. How will you support our annual IT support review and digital strategy?

ATS Connection supports schools and education settings alongside our business clients. At Brighton College, we rolled out endpoint antivirus across the whole network, where hundreds of pupils use computers and plug in storage devices every day, and it now runs with minimal attention from the network manager. See our IT support for schools and education and telecoms for education, or book a free cyber security audit against the standards.

Frequently asked questions

What are the DfE digital and technology standards?

Guidance from the Department for Education setting out what schools and colleges should have in place for broadband, Wi-Fi, networking, leadership and governance, filtering and monitoring, cyber security and more. Six core standards should be met by 2030, with many requirements applying now.

Do schools have to meet the digital and technology standards?

The DfE says all schools and colleges should be working towards the six core standards by 2030. The cyber security and filtering and monitoring requirements are expected now, and backups must be in place immediately.

What backups does the DfE require for schools?

At least three copies of your data, two of them on separate devices and one offsite. Backups must be immutable and tested every term or after significant changes. RPA members also need an offline backup for cyber cover.

Do schools need Cyber Essentials?

No. Cyber Essentials is a funding requirement for colleges but optional for schools. The DfE says meeting its standards helps schools work towards certification.

How many schools have a cyber attack?

The Cyber Security Breaches Survey 2025/2026 found 49% of primary schools and 73% of secondary schools identified a breach or attack in the previous 12 months.

What are the RPA cyber cover conditions?

Offline backups, NCSC cyber security training for staff and governors with IT access, registration with Police CyberAlarm, and a cyber response plan.

Can a school’s IT support be done remotely?

Most day-to-day issues can be fixed remotely. A good provider combines remote support with scheduled and on-demand on-site visits for hardware, installations and network work.

Sources

• DfE: Meeting digital and technology standards in schools and colleges
• DfE: Cyber security core standard
• DfE: Filtering and monitoring core standard
• DfE: IT support standard
• DfE Cyber Security Hub: Risk Protection Arrangement
• GOV.UK: Cyber Security Breaches Survey 2025/2026, education institutions findings
• DfE: Keeping Children Safe in Education 2026