Multi academy trusts, federations and groups of schools face a particular data protection challenge. Each school handles personal data every day, but accountability sits with the trust. The Initial Trust Plan is a checklist that gives your central team a clear, high-level picture of where the trust stands and what needs attention first.

This article is part of our Governance Week series. It brings together everything you need to know about the Initial Trust Plan: what it covers, who should own it, how it fits with the ICO Accountability Framework and how to get started.

Read more …

The National Cyber Security Centre (NCSC) published its Annual Review 2026 on 3 November. It looks back on the NCSC's tenth year, from September 2025 to August 2026, and ahead at the threats coming next.

Read more …

The worst time to work out who’s supposed to do what is during the incident itself. A cyber incident response plan only earns its name if it’s been read, agreed, and actually rehearsed before the day it’s needed.

Read more …

WhatsApp is one of the most common questions we're asked about. Staff want to know whether they can use WhatsApp groups for school messages, and it's easy to see why: it's familiar, free and quick. But using a personal messaging app for school business brings real data protection, safeguarding and security risks. This article sets out those risks, what the ICO and WhatsApp itself say, and what schools and trusts should do instead.

Read more …

Hackers are always finding new ways to break into accounts, and password attacks remain one of the most successful routes into school and trust systems. Password security isn't just an IT job: everyone with a login has a part to play.

Read more …

This article explains what a cyber incident is and what you should do if your school or trust experiences one. A cyber incident isn't necessarily a full-blown cyber attack, but it should still go through your reporting and risk management processes.

Read more …

Antivirus software used to be something you installed once and forgot about. That’s no longer good enough,  not because the software changed, but because what it’s defending against did.

Read more …

This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we're taking a different angle. Cyber security in a school or trust isn't a job for one person or one department; it's a set of responsibilities spread across several roles, each with a different part to play.

Read more …

Filtering and monitoring sit either side of the same boundary. Filtering is preventative, it stops users reaching illegal, inappropriate, or harmful content before they ever see it. Monitoring is reactive, it watches what's actually happening on your network and devices, so concerning activity doesn't go unnoticed. Together, they're one of the few controls that serve both cyber security and child safeguarding at once.

Read more …

Day 16 looked at access control from the outside in: securing the connection when staff work beyond school walls. Today we go back to the perimeter itself: the firewall every one of those connections has to pass through, and the network behind it. A firewall that's switched on but never reviewed, or a network where one device can talk to everything else, undoes a lot of the good work covered so far this month. Perimeter and gateway security is less glamorous than ransomware or phishing, but it's the layer that decides whether an intrusion stays contained or spreads.

Read more …

Every attacker chasing a school network has the same goal once they're in: find an account with more power than it needs. A compromised standard user account is a nuisance. A compromised admin account is a takeover, it can touch every system, every dataset, and every piece of security infrastructure built to stop exactly this. It can probably reset passwords.

Read more …

Over the past two weeks, we've covered how attackers get in:  phishing, deepfakes, ransomware, and what to do when they do. Access control is about the layer that decides whether any of that actually works: even a perfectly crafted phishing email or a stolen password is useless to an attacker if the account behind it is properly protected. Today we look at the single most effective access control measure available, where it still falls short, and what's changing.

Read more …