The DfE’s Six Core Digital and Technology Standards: A Complete Guide for Schools and Trusts

The Department for Education expects every school and college in England to meet six core digital and technology standards by 2030:

• broadband internet

• wireless network

• network switching

• digital leadership and governance

• filtering and monitoring

• cyber security

Academy trusts are expected to understand these standards and be working towards them, as set out in the Academy Trust Handbook. Most of the filtering and monitoring and cyber security requirements are expected to be in place now, not in 2030.

What are the DfE digital and technology standards?

The DfE’s digital and technology standards describe what safe, reliable and well-governed technology looks like in schools and colleges. The full framework covers many areas, including network cabling, servers and storage, cloud solutions, laptops, desktops and tablets, and IT support. Six of these have been designated core standards. These are the foundations everything else depends on, and they are the ones schools are expected to meet by 2030.

The standards were first published in 2022 and have been updated several times since. In 2025, following a national consultation on narrowing the digital divide, the DfE confirmed its 2030 ambition for the six core standards. The most recent update, in September 2026, strengthened several cyber security requirements, including faster patching and immutable backups.

Are the DfE digital standards mandatory?

The standards are not legislation in their own right. However, calling them ‘optional’ would be misleading, for four reasons:

• Academy trusts: The Academy Trust Handbook states that trusts should understand the six core standards and be working towards meeting them by 2030. Trust boards and auditors increasingly treat them as the benchmark.
• Safeguarding: The filtering and monitoring and cyber security standards set out the DfE’s recommended way of meeting statutory duties in Keeping Children Safe in Education (KCSIE). The statutory duty is not new, and the DfE says schools should already be meeting these standards.
• Insurance: Several cyber requirements are conditions of cover under the DfE’s Risk Protection Arrangement (RPA), including a cyber response plan, annual NCSC staff training and a robust backup regime.
• Colleges: Cyber Essentials certification is a requirement under college funding agreements.

In practice, a school or trust that cannot evidence progress against the six core standards will struggle to satisfy governors, trustees, auditors and insurers.

Quick reference: The six core standards at a glance

1. Broadband internet standard

Almost everything a modern school does depends on its internet connection, including cloud MIS, online assessment, Microsoft 365 or Google Workspace, VoIP telephony and safeguarding systems. The broadband standard has three parts.

Use a full fibre connection. Broadband should be delivered over full fibre, such as a leased line or fibre to the premises (FTTP). Copper-based services do not meet the standard, and this includes FTTC (“fibre to the cabinet”), which runs over copper for the final stretch. The minimum speeds are:

• Primary schools: 100Mbps download and 30Mbps upload
• Secondary schools, all-through schools and FE colleges: capacity for 1Gbps download and upload

The DfE expects schools to move to full fibre at the end of their current contract, or as soon as full fibre becomes available. Any new contract on a non-fibre service should allow an upgrade as soon as fibre arrives.

Have a backup connection. Broadband is now an essential service, so a single line is a single point of failure. The standard calls for a combination of:

• a secondary connection of a different type to the primary, such as a leased line backed by FTTP, or FTTP backed by low Earth orbit satellite
• router configuration that provides automatic failover
• redundant power for core network equipment

Have appropriate security and safeguarding systems. A correctly configured firewall, either on premises or managed by your provider, plus content filtering that meets KCSIE.

What we see in schools: Primaries still on FTTC are common. So are backup lines that have never been tested, and backup connections that bypass the school’s filtering altogether. The filtering standard explicitly requires all internet feeds to be filtered, including backup connections and portable Wi-Fi devices.

Evidence to hold: connection type and contract end date, speed tests taken during the school day, a record of the last failover test, and firewall ownership and configuration.

2. Wireless network standard

As learning moves onto laptops, tablets and cloud platforms, Wi-Fi has to work wherever teaching happens, including halls, sports areas and outdoor spaces where needed.

Use the latest wireless standard when you upgrade. When an upgrade is due, the DfE now specifies Wi-Fi 7 (802.11be) as the minimum. The network should support segregation and quality of service (QoS), and the network interface speeds of the access points (typically 1, 2.5, 5 or 10Gbps) need to match the switching behind them.

Provide full coverage. Coverage should reflect how many people use each space, not just floor area. That can mean an access point in every classroom and higher-capacity units in halls. The design should be based on a wireless heat-mapping survey.

Manage the network centrally. A central platform should configure the access points, monitor performance, raise alerts and push security updates automatically. The DfE also expects manufacturer warranty and support, administrator training, and a configuration file that can restore the school’s original setup.

Stop unauthorised access. Measures include VLANs, access control lists, segregated guest access, WPA3 authentication, wireless intrusion protection, certificate-based authentication, and MFA for privileged and technical accounts.

When: The DfE expects this standard to be met when an existing solution is underperforming or out of support. That makes it a planning and budgeting issue, which a refresh schedule should address.

What we see in schools: Access points that are well past end of support, consumer-grade kit in mobile classrooms, and guest and pupil devices sharing a network with staff systems.

Evidence to hold: a coverage survey, an access point inventory with support end dates, the management platform in use, and a network segregation design.

3. Network switching standard

Switches connect devices, access points, servers and the internet. They are also where many schools lose performance without realising it: a Wi-Fi 7 access point behind an old 100Mbps switch will never deliver what it promises.

Fast, reliable and secure connections. The requirements are:

• at least 1Gbps to desktop devices
• multi-gigabit ports for access points, servers and media devices
• 40Gbps stacking interconnects where switches are stacked
• at least 2×10Gbps links from hub rooms back to the core, ideally taking different routes

Power over Ethernet (PoE) must meet the power requirements of the devices it feeds, such as access points, CCTV, door access control and phones.

Central management and support. A central management tool should cover both core and edge switches. Each switch needs a minimum of five years of manufacturer warranty and support, including firmware updates. Equipment that can no longer receive security updates should be replaced.

Security features. These include network access control (NAC), segregation and QoS, secure and documented administrator accounts, and automatic firmware updates backed by manual checks.

Resilience. Critical core switches should have two power supplies, two management modules and dual connections to other critical infrastructure, and should be connected to at least one UPS.

What we see in schools: Unmanaged desktop switches in classrooms, core switches with no UPS, and no current network diagram, which the cyber security standard also requires.

Evidence to hold: a switch inventory with firmware versions and support end dates, a current network diagram, and UPS and redundancy arrangements.

4. Digital leadership and governance standard

This is the standard that makes the other five achievable, and it is often the one with the largest gap. The DfE sets out four requirements and advises completing the first three before the fourth.

Assign a senior leader responsible for digital technology. The headteacher appoints an SLT digital lead. This is usually someone with teaching experience rather than a technical specialist. They are accountable for the digital strategy, for reviewing how well IT support is performing, and for staff and pupil training needs. Governors and trustees should consider appointing a digital link governor or trustee.

Keep registers up to date. Three registers are needed:

• a contracts register, covering licences, subscriptions, broadband, IT support and approved apps
• an asset register, recording each device’s age, location, assignee, review date and secure disposal
• an information asset register, owned by the DPO

The DfE provides templates for all three through its Plan technology for your school service.

Include digital technology in disaster recovery and business continuity plans. These plans should define what a “disaster” means for your school. They should name the recovery team and key contacts, be tested at least once a year, and be kept in both printed and secure cloud form, so they remain available during a cyber incident.

Have a digital technology strategy reviewed every year. The strategy should cover at least two years, align with the school development plan, cover refresh and replacement, and be reviewed at least annually. It is overseen and challenged by governors or trustees.

What we see in schools: Registers held in spreadsheets that nobody owns, strategies with no costed plan behind them, and continuity plans that were written once and never tested.

Evidence to hold: the name of the digital lead, current versions of all three registers, a DR/BC plan with its last test date, and an approved strategy with evidence of its annual review.

5. Filtering and monitoring standard

Filtering and monitoring are safeguarding responsibilities first and technology responsibilities second. The DfE says schools should already be meeting this standard. It has four parts.

Assign roles and responsibilities. Governing bodies should name a member of SLT and a governor responsible for the standard. The DSL leads on safeguarding and online safety, including checking reports and giving governors assurance. IT support maintains the systems and produces reports.

Review provision at least once every academic year. SLT, the DSL, IT support and the responsible governor should carry out the review together. It should consider:

• pupils’ risk profile, including age, SEND and EAL
• BYOD arrangements
• where generative AI tools are used
• local safeguarding context, such as county lines
• teaching needs, such as RSHE and PSHE

Checks should be logged, recording when they happened, who carried them out, what was tested and what action followed. A further review should take place whenever new technology, AI tools or significant changes are introduced.

Block harmful content without unreasonably affecting teaching. The filtering provider must be an IWF member, signed up to the CTIRU list, and those blocklists must be impossible for anyone to disable. Filtering should:

• use separate staff and pupil profiles, not a single blanket profile
• apply to managed devices off site, BYOD and guest access
• block VPNs and proxies
• identify the device, the time and the content involved in each blocked attempt

The September 2026 update also expects schools to consider how their filtering handles AI-generated and dynamic content.

Monitor effectively. Staff should supervise pupils in person whenever devices are in use. Where technical monitoring is used, the minimum is weekly reports, with immediate alerts for high-risk incidents. Every incident needs a documented record of the action taken and the outcome.

What we see in schools: Annual reviews that happened but were never written down, blanket filtering profiles, and backup connections or mobile hotspots that bypass the filter.

Evidence to hold: the review record, a log of checks, the names of the responsible SLT member and governor, and incident and response records.

6. Cyber security standard

Cyber attacks can close schools, compromise safeguarding data and cost huge sums to recover from. This is the most detailed of the six standards and has the most recent updates. It covers seven areas.

Conduct a cyber risk assessment every year and review it every term. The SLT digital lead coordinates this with IT support, the DPO, the estates team, the finance team and governors. Cyber risks belong in the risk register, and a cyber response plan should form part of the business continuity plan. That plan is also a condition of RPA cover.

Create a cyber awareness plan. This means an acceptable use policy that everyone signs, including guests and supply staff. It also means cyber training at least once a year for staff, pupils and at least one governor or trustee. For RPA members, evidence of the free NCSC training is required annually.

Secure technology with a firewall and anti-malware. The firewall should be correctly configured, with termly firmware checks, MFA on the admin interface and a documented, termly-reviewed record of any inbound rules. Anti-malware should be centrally managed. USB storage should be blocked by default. Email should be configured to prevent spoofing.

Control user accounts and access. Every user needs unique credentials, and each account should have only the access its role requires. MFA is required for all staff accounts that access cloud services or remote systems, and for all IT admin accounts. There should be a joiners, movers and leavers process, with accounts reviewed each term. Separate admin accounts should never be used for day-to-day work.

License technology and keep it up to date. All software must be licensed and supported. Under the September 2026 update, critical and high-risk vulnerabilities (CVSS 7.0 or above) must be patched within 14 days. Devices that cannot be patched should be isolated.

Back up data and review the plan every year. Keep at least three copies of important data on two separate devices, with one copy off site. Backups should be immutable, meaning they cannot be altered once written. Restores should be tested and logged every term.

Report cyber attacks. Incidents should be reported to your RPA or insurer, Report Fraud and the DfE sector cyber team. Depending on the incident, you may also need to report to the NCSC, and to the ICO within 72 hours if a high-risk data breach may have occurred.

How this relates to Cyber Essentials: The DfE standards focus on governance, process and strategy. Cyber Essentials is an annual, independently assessed certification of technical controls. Colleges must hold it. For schools it is optional, but it is a strong, externally verified way to demonstrate the technical side of this standard.

What we see in schools: MFA switched on for some staff but not all, backups that have never been restored in a test, patching that takes weeks rather than days, and governors who have never received cyber training.

Evidence to hold: the risk assessment and termly reviews, training records, MFA coverage reports, patch compliance reports, backup and restore test logs, penetration test results, and an incident register.

How the six standards connect

The standards are closely linked, and treating them separately is one of the most common and costly planning mistakes:

• Infrastructure chain: Wi-Fi performance is limited by switching, and switching is limited by cabling. Upgrading access points without the switches and uplinks behind them wastes money.
• Resilience versus safeguarding: A new backup broadband line must also be filtered. Otherwise meeting the broadband standard can break the filtering standard.
• Registers support security: The asset and contracts registers from the leadership standard are what make the cyber requirements for licensing, patching and end-of-support deliverable.
• One plan, not six: The digital strategy should bring every refresh, contract renewal and risk into a single costed roadmap.

Who is responsible?

A practical roadmap to 2030

The date “2030” can create a false sense of time. Much of the filtering and monitoring and cyber security standards should already be in place. The infrastructure standards are triggered by refresh and contract cycles, so most schools will have only one opportunity to get each of them right before 2030.

1. Now: Appoint the SLT digital lead and governor roles. Bring the registers up to date. Complete and document the filtering and monitoring review. Close urgent cyber gaps, particularly MFA, patching, immutable backups and the response plan.
2. Next 12 months: Baseline every site against all six standards, using the DfE’s free Plan technology for your school service as a starting point. Record the evidence you already hold.
3. Next budget cycle: Turn the gaps into a costed strategy covering at least two years, aligned to contract end dates and equipment support dates.
4. 2027 to 2030: Deliver the infrastructure upgrades in the right order (cabling, then switching, then wireless), review everything annually, and report progress to governors and trustees.

Guidance for multi academy trusts

For trusts, the challenge is consistency and visibility across multiple schools. Good practice includes:

• a trust-wide baseline
• a shared set of approved suppliers and apps
• consolidated registers
• a trust IT budget that plans refreshes across schools, rather than letting each school fail at a different time
• a board report showing every school’s position against every standard

Some responsibilities usually sit centrally, such as strategy, procurement and cyber governance. Others must remain at school level, such as the DSL’s day-to-day filtering and monitoring role.

How School IT on a Page helps

School IT on a Page was designed and built by L.E.A.D. IT Services to do exactly this job. It:

• tracks every core standard alongside Cyber Essentials, filtering and monitoring, AI, RPA and Microsoft/Google security baselines
• holds evidence within an immutable audit trail
• records cyber assurance activity, such as penetration tests, incident logs and backup tests
• turns gaps into a costed five-year plan with multi-level approvals and a trust-wide budget view

One-click reports give governors, trustees and auditors a current picture in seconds.

How L.E.A.D. IT Services can help

As part of LEAD Academy Trust, we understand the standards from the inside. We offer fully managed IT support, infrastructure design, cyber security, safeguarding and filtering, and strategic consultancy for schools and trusts. Talk to our education team about a baseline review against the six core standards.