Cyber security in schools: questions for governors and trustees

TIP: Cyber incidents or attacks should be considered in terms of risk management and be listed on the school's risk register, alongside other IT and data risks. Cyber security should be referenced in any relevant school policies (e.g. business continuity, data protection, acceptable usage etc). It is also advisable to have cyber security as a regular agenda item at board meetings as with other topics like GDPR and the physical security of the school.

Good cyber security is dependent on people. Staff can alert schools to potential problems like spotting phishing emails or phone calls, or noticing when a service is running particularly slowly, which could be a sign of a cyber attack.

TIP: Assurance can be sought by asking the school’s staff to take part in cyber security training. Free training is due to be published on the NCSC’s website in September 2020. There are other training resources like the Practical Tips guide which can be downloaded from the NCSC’s website.

All types of schools can experience a cyber incident. A cyber incident could result in a school’s network being unavailable for an unknown period of time, with limited or no access to important data and services. The importance of access to the MIS has been covered earlier in theme A, but there are other services like: telephones, access control systems, cashless payment systems. These will impact on the school’s operation if they are unavailable. 

TIP: Assurance can be sought in this instance by establishing whether the school has a business continuity plan in place, that includes IT and these wider services. For example, it might be that your school holds a paper copy of the school register and parent contact information. This way a school can increase its chances of functioning in the event of a cyber incident. Key to this is the list of IT service suppliers the school uses including contact numbers. The NCSC’s 10 steps to Cyber Security and the Response and Recovery Guide can help inform the school and provide governors with assurance.

A school’s business continuity plan should list its key external IT supplier/providers as well as those responsible for the management of IT within the school. It is very important that up-to-date contact information sits alongside this. 

TIP: A school establishing what role these IT suppliers/providers will perform in the event of a cyber incident would be very beneficial at this planning stage. If additional support or expertise is needed in the event of an incident this should be identified beforehand. A school may also want to list important contact information from: the local authority, chair of the governing body and local law enforcement. Reporting cyber incidents can be made to Report Fraud or, if you're in Scotland, then reports should be made to Police Scotland. If the incident involved a data breach it may be necessary to report it to the Information Commissioner’s Office (ICO) under GDPR guidelines.