Cyber security for schools and nurseries: what to actually do first

Short answer: the three things that stop most attacks on a school or nursery are multi-factor sign-in on every staff account, a backup somebody has actually restored, and taking admin rights off day-to-day logins. None of them costs much. All three are usually missing.

Cyber security for schools tends to arrive as either a scare or a shopping list, and neither helps a business manager with a budget and a term to get through. So here is the practical order: what the standards actually ask for, what to do first, and how to tell whether the school is in decent shape without paying anyone to tell you.

Want a straight answer on where your school stands? Ring 0151 452 3060 and a person picks up. If the honest answer is that you are fine and should spend the money on something else, that is what you will get.

Why school IT security is a different job

A school holds more sensitive data per head than almost any small organisation: safeguarding records, SEND information, family circumstances, medical notes, photographs. It also runs the least controllable network in the sector, with hundreds of pupil devices, staff working from home, parents on the guest wi-fi and a management information system that everything else hangs off.

On top of that, the people who run it are teachers and administrators, not IT staff. A primary might have one technician shared with three other schools. A nursery group might have nobody at all. So any advice that assumes a security team is useless here, and most published advice assumes exactly that.

The Government’s Cyber Security Breaches Survey (DSIT 2025) found 43% of UK businesses identified a breach or attack in the previous year, and that 85% of attacks start with phishing. That second figure matters more than the first, because it tells you where to spend: not on a clever product, but on making a stolen password useless.

What the standards actually ask for

Three things apply to schools in England, and they overlap more than they look.

Keeping Children Safe in Education (KCSIE) makes online safety a safeguarding matter and puts it with the governing body. In practice that means filtering and monitoring that work and can be evidenced, and a leadership team that knows what is in place rather than assuming the provider has it covered.

The DfE’s cyber security standards for schools and colleges are the most directly useful document in this space and hardly anyone reads them. They are written as plain statements: use multi-factor authentication, protect accounts with administrative privileges, keep software up to date, have a backup that is tested, have an incident response plan. If you only read one thing, read those.

UK GDPR sits over all of it, enforced by the ICO, and covers every record you hold on a child or a family. A breach involving safeguarding data is the version of this that keeps people awake, and rightly.

Notice what is not on that list: no product names, no annual spend, nothing that needs a consultant. The standards are asking for habits, not hardware.

The three things to do first

1. Multi-factor sign-in on every staff account, with no exceptions. If 85% of attacks start with phishing, the whole game is what happens after somebody’s password is taken. With multi-factor on, a stolen password is worth very little. Without it, one tired click in week six is a full mailbox, and that mailbox has safeguarding conversations in it. The exceptions are what kill schools here: the head who found it annoying, the shared office account, the old system that “cannot do it”. Those are exactly the accounts that get used.

2. A backup somebody has restored. Not a backup that exists. A backup that has been opened, restored from, and timed. The question to ask, in this form: if the MIS and the shared drive were both encrypted tonight, what would we have back by Monday, from where, and who has done it before? If nobody can answer in a sentence, that is the finding, and it is the most valuable half hour anyone will spend this term. Worth checking that your Microsoft 365 data is included, because a lot of people assume it is and it usually is not by default.

3. Take admin rights off everyday accounts. Most school networks have grown over a decade and accumulated staff logins with far more power than the job needs, plus a handful of shared administrator accounts whose password several people know and nobody has changed since the last technician left. Separating “the account I teach with” from “the account that can change things” stops an ordinary mistake becoming a school-wide one.

Do those three and you are ahead of most schools, and you have done the bulk of what the DfE standards ask for.

Want somebody to check the three for you? That is what a cyber security review for a school is: an outside look at sign-in, backup and access, written down plainly enough to take to governors. See cyber security for schools and academies.

The next three, once those are done

Leavers, on the day. Staff, supply, volunteers, governors, students. Access ends when the person does. Schools are unusually bad at this because so many people pass through, and a login that still works six months after somebody left is the easiest possible way in.

Know what you are actually running. A list of the systems that hold pupil data, who the supplier is and who at school owns the relationship. Most schools cannot produce this, which means nobody can answer a supplier-breach question quickly, and supplier breaches are now as common as direct ones.

An incident plan that fits on one page. Who is rung first, who decides to close the network, who speaks to parents, where the numbers are written down if the email is gone. Governors ask for this, and the version that exists only in a technician’s head does not count.

Cyber Essentials for schools: worth it or not?

Cyber Essentials is a UK government-backed scheme covering five basic controls, and for a school it is genuinely useful as a structure even if you never certify. It makes you check the boring things in order, and it produces something a governing body can read.

Whether to certify depends on why you would. If a funder, a trust or an insurer is asking, certify. If nobody is asking, run to the standard without certifying and spend the certification fee on fixing whatever the exercise finds. That is usually the better trade for a single school, and any provider telling you otherwise should be asked who benefits.

A five-minute check you can run this week

• Is multi-factor sign-in on for every staff account, including the head’s and any shared ones?
• When was the backup last restored, not last run, and who did it?
• Does the backup include Microsoft 365, or only the server?
• How many accounts have administrator rights, and can you name every one?
• Can you list every system holding pupil data and who supplies it?
• Did the last person to leave lose access the day they left?
• If the network went down on a Monday morning, whose phone number is rung, and is it written somewhere that does not need the network?

Answer those honestly and you will know whether your school IT security is in reasonable shape. Most schools get four or five. The two or three that are missing are the whole job.

Where to start

Start with the backup question, because it takes ten minutes and the answer tells you a great deal about everything else. Then multi-factor, then admin rights. None of it needs a project and none of it needs a big budget.

Ring 0151 452 3060 and a person picks up. If you would rather just have the checklist above and get on with it yourself, that is a fine outcome and it is why it is written out in full.