The reported cyber attack on the Department for Education is another stark reminder that the education sector continues to be an attractive target for cyber criminals. While the information reported to have been compromised is currently described as limited to customer service contact details, incidents like this demonstrate how quickly disruption can occur and how important it is to build resilience before an attack happens.

Cyber resilience is not just an IT issue

At Digital Safety CIC, we are already working alongside schools, academy trusts and local authorities to address the underlying issues that often leave organisations exposed. In our experience, cyber resilience is about far more than technology alone. It requires strong leadership, informed governance, effective digital safeguarding, staff awareness and a culture where cyber security is recognised as a strategic organisational responsibility rather than simply an IT function.

The role of the DfE Digital and Technology Standards 2030

The Department for Education’s Digital and Technology Standards 2030 are an important step in the right direction, providing schools with clearer expectations around digital maturity and cyber security. However, they are not yet supported by a mandatory compliance framework that ensures every school is working to the same consistent minimum standard. Without greater accountability, assurance and independent oversight, there will inevitably remain a gap between understanding the risks and having the capability, confidence and resources to manage them effectively. In the North East, we are supporting the development of a practical framework to help schools implement these standards in a structured and measurable way.

Why schools remain exposed

Schools hold some of the most sensitive information in society, from children’s personal data and safeguarding records to staff information and operational systems. At the same time, they face growing pressure on budgets and resources while cyber threats continue to evolve in both scale and sophistication. The increasing availability of AI-enabled tools is also changing the threat landscape, making attacks more accessible, faster to execute and increasingly difficult to detect.

Moving beyond guidance alone

The conversation now needs to move beyond guidance alone. Education providers need practical support, achievable standards and ongoing development that enables them to strengthen their resilience over time. Through our work, we are helping schools develop the knowledge, governance and practical capability needed to protect their communities and build confidence in the safe use of technology.

Building collective resilience across education

This is also why we are bringing together education leaders, cyber security professionals and safeguarding experts through our upcoming cyber resilience event. Sharing good practice, learning from real-world incidents and encouraging collaboration across the sector are essential if we are to strengthen resilience collectively rather than expecting individual schools to face these challenges alone.

As a Community Interest Company, Digital Safety CIC exists to help protect and support everyone who operates in the digital world – not only children and young people, but also the professionals, families and organisations responsible for their education, wellbeing and future. Cyber resilience is no longer optional; it is a fundamental part of safeguarding education in the digital age.