Cyber security is a leadership responsibility – not just an IT issue

Ofqual’s latest cyber security survey provides an important reminder for schools, academies and trusts: cyber security cannot simply be delegated to the IT team.

Ofqual’s latest annual cyber security survey of schools and colleges contains some encouraging signs. The proportion of settings reporting a cyber security incident has fallen, and more organisations affected by an incident are recovering quickly.

But one finding should particularly interest headteachers, trust leaders, governors and data protection leads.

Only 9% of respondents identified senior leadership as primarily responsible for cyber security.

That matters because cyber security in a school is not simply a technical issue. It is an information governance, safeguarding, operational resilience and leadership issue too.

What did Ofqual find?

The survey found that:

• 27% of schools and colleges reported experiencing a cyber security incident, down from 29% the previous year.

• 66% of affected settings recovered immediately, compared with 55% the previous year.

• Only 9% identified senior leadership as primarily responsible for cyber security.

• Ofqual highlighted the importance of measures including cyber security policies, risk assessments, backups and recovery arrangements.

The overall direction is positive, but the findings raise an important question:

Who actually owns cyber risk in your school or trust?

Why this is also a data protection issue

Schools hold significant amounts of personal data, much of it relating to children and some of it particularly sensitive.

That can include safeguarding information, SEND and EHCP documentation, medical information, attendance records, behaviour records, staff information, contact details and assessment data.

A successful cyber attack can therefore become a personal data breach very quickly.

For example, an attack could result in personal information being accessed by an unauthorised person, records becoming unavailable, information being altered or destroyed, or staff losing access to systems containing information needed to keep pupils safe.

Under UK data protection law, organisations must have appropriate technical and organisational measures in place to protect personal data.

The word organisational is important.

Firewalls, filtering, antivirus software and secure systems matter, but they are only part of the picture. Schools also need effective governance, clear responsibilities, staff awareness, appropriate policies and a tested response when something goes wrong.

It cannot just belong to IT

IT professionals and managed service providers will understandably play a major role in protecting school systems.

But responsibility for the risk itself cannot simply be outsourced.

Senior leaders and governing bodies should understand the school’s cyber risks in much the same way that they understand other significant organisational risks.

They do not need to become cyber security specialists. They do need sufficient assurance that appropriate controls are operating.

There should also be a clear connection between cyber security, data protection and business continuity arrangements.

For example, if a ransomware attack prevented access to your management information system tomorrow:

Would the school know what to do?

Could essential pupil information still be accessed?

Who would decide whether the incident constituted a personal data breach?

Who would contact the DPO?

Could the school determine what information had been compromised?

Who would decide whether notification to the ICO was required?

Could essential services continue while systems were unavailable?

Those are leadership and governance questions, not simply IT questions.

Six questions schools should ask now

Ofqual’s findings provide a useful opportunity for schools and trusts to review their arrangements.

Senior leaders and governors should be able to answer six straightforward questions:

1. Who owns cyber security risk?There should be clear senior leadership accountability, even where technical responsibility sits with an internal IT team or external provider.

2. Is cyber security included within the organisation’s risk management arrangements?Significant cyber risks should be visible to leaders and governors rather than remaining solely within an IT function.

3. Do we have an up-to-date cyber security policy and incident response arrangements?Staff should know what to do and whom to contact if an incident occurs.

4. Are backups effective and recoverable?Having backups is not enough. Schools need confidence that critical information can actually be restored.

5. Do staff understand their role?Phishing, compromised accounts and human error remain significant risks. Cyber awareness should form part of the school’s wider information governance culture.

6. Is our cyber response connected to our data breach procedure?A cyber incident involving personal data should trigger the school’s data breach assessment process so that the DPO can advise on risk and whether further action, including notification to the ICO, is necessary.

Is anything legally changing?

The Ofqual survey does not create a new legal requirement for schools.

However, it reinforces responsibilities that already exist.

Schools and trusts processing personal information are already required to ensure appropriate security under UK data protection legislation. Depending on the setting, DfE cyber security standards and other sector requirements and guidance will also be relevant.

The distinction is therefore important:

This is not a new compliance deadline. It is a timely warning to check whether existing responsibilities are being managed effectively.

A useful governing body discussion

Cyber security does not necessarily require a lengthy new agenda item.

A useful starting question for the next governing body or trust board meeting might simply be:

“How do we know that our school could continue operating safely following a significant cyber incident?”

The answer will quickly reveal whether cyber security is being treated purely as a technical function or as an organisation-wide governance risk.

And that is perhaps the most important message from Ofqual’s latest findings.

Good cyber security needs good technology. But it also needs good governance.

How SchoolDPO can help

SchoolDPO supports schools with practical data protection and information governance, including reviewing policies and procedures, responding to personal data breaches and helping schools understand how cyber incidents interact with their UK GDPR responsibilities.

If your school would like support reviewing its data protection, breach response or wider information governance arrangements, please get in touch.

SchoolDPO – practical data protection support for schools.