School cyber attack plan: what the DfE expects before an incident

Why every school needs its own cyber response plan

The Department for Education Cyber Security Hub defines a cyber response plan as the document that coordinates the activities and process to follow during a suspected incident. It provides a template, but says schools should tailor it to their own structure and ways of working.

That detail matters. A maintained primary school, a secondary academy and a school within a trust may use different suppliers, escalation routes and decision makers. The plan needs to work alongside safeguarding, data protection, business continuity, communications and acceptable use policies, as well as agreements with IT and other service providers.

The DfE also advises schools to keep printed copies, or a version that remains accessible during an attack. A plan stored only in the affected network or cloud account may disappear at the moment it is needed most.

The NCSC makes the same broader point: preparation helps people make sound decisions under pressure and reveals gaps before a real incident. It recommends key contacts, escalation criteria, a basic process, alternative communications and guidance on legal or regulatory duties.

DfE checklist for preparing a cyber response plan

NCSC guidance on planning an incident response

Who should hold each responsibility?

The DfE advises establishing a cyber recovery team led by an SLT digital lead. Each named role needs a deputy, current contact details and enough training to act. The exact job titles can differ, but ownership should not be vague.

• The headteacher maintains leadership oversight, activates the plan with the recovery team, keeps governors and the data protection officer informed, and approves important communications.
• The SLT digital lead coordinates the response, owns escalation decisions, delegates tasks and acts as the central point for incident management.
• The IT lead or IT provider investigates the technical position, protects unaffected records, advises on containment, confirms backup status and estimates the effect on services and recovery time.
• The school business manager coordinates operational contacts, telephony and parent communication routes, and checks the effect on finance, payroll, human resources and office processes.
• The data protection officer assesses personal data implications and advises whether the Information Commissioner's Office must be notified.
• The designated safeguarding lead decides whether the incident creates a safeguarding concern and coordinates any necessary referral or protective action.
• The chair of governors supports the headteacher, helps approve urgent resources, keeps governors appropriately informed and contributes to the later review.
• A named record keeper maintains the decision log and timeline while technical staff preserve logs, system details and forensic information.

DfE roles and responsibilities for a school cyber incident

Agree what staff should report and how to escalate it

An incident may first appear as a fake email, missing files, unusual account activity, a device behaving strangely or a supplier warning. Staff, learners and parents can all be an early source of detection. They need one simple reporting route and an alternative if normal email or telephones are unavailable.

The DfE recommends a clear first point of contact, usually the SLT digital lead, and a reporting culture that does not blame people for raising a genuine concern. Even low level events can be recorded to help identify a pattern.

Define the point at which a report becomes an incident. Evidence of malware, possible compromise, sensitive data at risk or an unavailable critical system should prompt immediate escalation. The plan should state who can classify severity, who must be told, and how the recovery team is convened when key staff are off site or unavailable.

Triage should establish what happened, when it began, who is affected and which systems or information may be involved. The DfE advises treating unusual activity as a possible cyber incident until it has been assessed, while recording the decision even if it turns out to be an ordinary IT fault or false alarm.

DfE detection and reporting guidance

DfE triage and analysis guidance

Decide when IT may act without waiting for approval

The DfE says schools should document when IT support may act without further authorisation to reduce risk and impact. This prevents avoidable delay when a compromised account needs disabling or an infected device needs isolating. It also protects leadership decisions that should remain with the school.

Write down the permitted actions and thresholds with your IT provider. Examples might include disconnecting a clearly infected device, blocking a confirmed malicious address or disabling a compromised account. Wider shutdowns, public statements, spending decisions and notifications normally need named approval routes.

Containment must be prompt but measured. DfE guidance warns against shutting systems down immediately unless needed to prevent critical impact, and against wiping or rebuilding devices before evidence is captured. A hurried action can destroy useful evidence, spread damage through synchronisation or cause more disruption than the original event.

DfE guidance on containing a school cyber incident

Preserve records and evidence from the first report

Accurate records support decision making, safeguarding, data protection duties and the review that follows. The DfE recommends an objective incident log with detailed timestamps, actions, decisions and named owners. Record verbal decisions as well as actions taken through technical systems.

The SLT digital lead normally oversees the non technical record, while IT preserves logs, forensic information and system level details. Store records securely, limit access to people who need them, mark drafts clearly and retain them according to the school's policy.

Do not ask staff to investigate by repeatedly clicking a suspicious link or opening a malicious attachment. Preserve the original message, alert or error details and tell IT what the user did. Removed devices should be labelled and protected from alteration. Specialists may need logs or volatile information before a restart or rebuild.

NCSC guidance recommends knowing in advance which logs exist, how they can be retrieved and who can access them. It also recommends consistent time settings so events from email, cloud services, firewalls and devices can be correlated.

DfE record keeping guidance for cyber incidents

NCSC guidance on logs and evidence

Plan communications before email stops working

Prepare short communication templates before an incident and agree who may approve and send them. The DfE advises factual, neutral messages that avoid blame and speculation. Record why a notification was or was not made, who received it and when.

The plan should cover staff, learners, parents and carers, governors, the trust or local authority, suppliers and the media. Not every audience needs every technical detail. People need clear information about the effect on learning, safeguarding, attendance, payments or communications and any action they must take.

Keep alternative contact details and an agreed meeting method outside the main school systems. Decide how updates will be issued if email, the website, the parent messaging platform or the telephone system is affected. Staff should know who speaks for the school and be asked not to speculate publicly.

DfE notification guidance for school cyber incidents

Coordinate the school, IT provider and external authorities

The school retains leadership of the incident even when technical work is outsourced. The IT provider needs current contact details, documented authority, access to necessary systems and clarity about who approves disruptive actions. The school needs honest technical updates on scope, data risk, backup status and likely recovery time.

List relevant external contacts in the plan, including the trust or local authority, insurer, Risk Protection Arrangement service where applicable, DfE, NCSC, police or the national fraud reporting service, and the Information Commissioner's Office. Contact requirements depend on the event, contracts and legal duties, so the headteacher, SLT digital lead, data protection officer and designated safeguarding lead should assess them together.

The DfE notes that a reportable personal data breach must be reported to the ICO within 72 hours of the school becoming aware of it. The data protection officer should advise whether that threshold is met. Reporting a cyber incident to the NCSC does not replace any separate legal or regulatory report.

Use a separate trusted device or connection to contact external bodies if the school network may be compromised. Keep reference numbers, advice received and copies of every formal notification in the incident record.

DfE notification duties and external reporting

NCSC cyber incident reporting service

Restore services safely and in the right order

Recovery is not simply switching everything back on. DfE guidance says systems and data should return in a secure and controlled way after vulnerabilities have been addressed and integrity checked. If an external IT provider leads the work, the DfE advises seeking written assurance that systems are safe to resume.

Agree recovery priorities before an incident. Safeguarding and welfare information, attendance, emergency contacts, medical information, telephony and essential administration may need to return before less critical services. Document temporary workarounds and how long the school can safely function without each system.

• Restore from a known clean and validated backup, or rebuild from a trusted image.
• Patch restored systems and close the route used in the incident before reconnecting them.
• Reset affected credentials, protect administrator accounts and review any changed permissions.
• Bring services back in stages and ask key users to confirm data and essential functions.
• Maintain increased monitoring after recovery and watch for renewed compromise or unusual access.
• Tell staff which systems are available, which remain restricted and what temporary procedures still apply.

DfE guidance on secure recovery

NCSC incident management guidance

Review the response and test the revised plan

After services are stable, record what happened, the effect on people and systems, the root cause, actions taken and how well decisions and communications worked. Assign each improvement to a named owner with a deadline. The DfE recommends updating plans, policies, training and technical controls from the lessons learned.

Governors should seek evidence that the plan exists, has named owners and is exercised. The NCSC provides a free Exercise in a Box service for practising realistic scenarios. A short exercise can reveal expired telephone numbers, inaccessible plans, unclear authority or a backup that nobody has recently restored.

Review the plan after an incident, exercise, supplier change or major technology project. A plan is useful only while the people, systems and contact details in it remain current.

DfE post incident review guidance

NCSC advice on practising and improving response plans

How Bury I.T. Support can support the plan

Bury I.T. Support can help a school document its systems, suppliers, backup arrangements and technical contacts, then work with leadership to define practical containment and recovery steps. We can also help test backup restoration and explain the technical parts of the plan in language that staff and governors can use.

The plan must still belong to the school. Safeguarding, communications, governance and data protection decisions need the right school leaders and advisers. Our role is to make sure the technical responsibilities, evidence sources and recovery assumptions are realistic and understood.

If you would like us to review your existing cyber response arrangements, speak to our school IT team. We will start with how your school operates and what needs to keep working, then identify the most important gaps.