DfE digital standards checklist for schools

The Department for Education’s Meeting digital and technology standards in schools and colleges guidance sets out what good school technology should look like. The manual was first published in March 2022 and, at the time of writing, was last updated on 16 September 2026.

It is a practical framework, not a single pass-or-fail certificate. All schools and colleges should be working towards six core standards by 2030:

• broadband internet
• wireless network
• network switching
• digital leadership and governance
• filtering and monitoring
• cyber security

Two of those — filtering and monitoring, and cyber security — are also the DfE’s recommended way to meet the statutory expectations in Keeping children safe in education (KCSIE) for appropriate filtering, monitoring and cyber security measures. You should already be treating those duties as current, not as a 2030 project.

There are further, non-core standards covering cloud solutions, digital accessibility, IT support, devices, network cabling, and servers and storage. They still matter, but the six core standards are the foundation the DfE asks every school and college to work towards first.

This checklist is a plain-English summary for headteachers, school business managers and trust IT leads. It is not a substitute for the official guidance, and it is not an audit or a compliance certificate. Always check the current pages on GOV.UK, because the standards are updated.

How to use this checklist

For each core standard, there is a short explanation of what the DfE currently asks for, followed by a few questions you can ask in school or with your IT support. A “yes” is useful evidence; a “not sure” is usually the most honest, and most helpful, answer.

The DfE also provides a free Plan technology for your school service to help you measure progress towards the six core standards. If you would like a second pair of eyes, Atom offers a free IT audit. We review your devices, network, filtering and backups against the DfE digital and technology standards. It is free and helps shape next steps—it is not a compliance certificate or guarantee. You can find out more on our school ICT support page, or get in touch.

1. Broadband internet

What it asks for. Schools and colleges should use a full fibre connection — typically described as a leased line or fibre to the premises (FTTP). Copper connections do not meet the standard.

Minimum speeds in the current guidance are:

• primary schools: at least 100Mbps download and 30Mbps upload
• secondary schools, all-through schools and further education colleges: a connection with the capacity to deliver 1Gbps download and upload

You should also have a backup broadband connection, so the school is not left without internet if the main line fails. The standard looks for different service types used together — for example a leased line with FTTP, or FTTP with low Earth orbit satellite — plus automatic failover and resilient power for core network equipment.

The DfE says you should implement this as soon as you can, usually at the end of an existing contract or when full fibre becomes available. New or extended contracts that are not full fibre should allow you to move to fibre when it is available. A content filtering system and a firewall are already expected as part of your KCSIE safeguarding duties.

Questions to ask

• Is our connection full fibre, and does it meet the minimum speeds for our type of school?
• Do we have a backup connection of a different type, with automatic failover if the main line drops?
• If we are mid-contract on a non-fibre service, can we move to full fibre when it becomes available?
• Has someone checked that our internal cabling, switches, router and wireless equipment will actually deliver those speeds to classrooms?

2. Wireless network

What it asks for. The wireless network should give you the coverage, capacity and security you need, including concurrent logon and use of devices across the site. When you need to upgrade an underperforming or unsupported system, the current standard is Wi-Fi 7 (802.11be). You do not have to rip out a network that still meets your needs simply because a newer standard exists.

Coverage should be strong wherever mobile devices are used, including outside if that is required. Planning should use wireless heat mapping, with enough access points for the planned occupation of each space — often up to one per classroom, and higher-specification units in halls and other high-capacity areas.

The network should be centrally managed, so IT support can configure access points, monitor performance, receive failure alerts and apply security updates. It should also support network segregation and quality of service (QoS). Performance still depends on the cabling and switches behind the access points.

Questions to ask

• Does Wi-Fi actually work, at the same time, in every space where staff and pupils need it?
• Is our wireless equipment still supported, and do we have a central tool to manage it and apply updates?
• If we are planning an upgrade, is the proposed solution Wi-Fi 7, with access-point uplink speeds that will not become a bottleneck?
• Was the design based on a heat map, and have we allowed for interference from other building systems?

3. Network switching

What it asks for. Switches should provide fast, reliable and secure connections for both wired and wireless users. Meet this standard when you need to replace a solution that is underperforming or unsupported.

In practical terms, the current guidance expects a minimum of 1Gbps to user devices at the desktop, and higher-speed (multi-gigabit) ports for equipment that needs more bandwidth, such as servers, media devices and wireless access points. Links between switch stacks and the core should be resilient. Switches that power devices such as access points, CCTV, access control and telephones must meet the manufacturer’s power requirements.

You should have a central management platform to configure core and edge switching, monitor performance and alert on failures. Equipment should come with at least five years of manufacturer warranty and support, including firmware and security updates. Kit that can no longer receive those updates should be replaced. Switches also need security features that stop unauthorised access while still allowing time-limited access for regular and guest users.

Questions to ask

• Are our switches still supported, and can they still receive firmware and security updates?
• Do classroom devices get at least 1Gbps, and do wireless access points and servers have faster ports where they need them?
• Can IT support manage, monitor and get alerts from the switching estate in one place?
• How do we give guests or visitors access without opening the rest of the school network?

4. Digital leadership and governance

What it asks for. This standard is about roles, records and plans, not about buying a particular product. The headteacher or principal should assign a senior leadership team (SLT) digital lead who is accountable for the digital technology strategy. They do not need to be a technical expert, though some knowledge or interest helps. The role usually sits with someone who has teaching experience, acting as a link between technical staff, the SLT, curriculum leads, the data protection officer, the designated safeguarding lead, business or finance colleagues, and, where relevant, a trust IT director. Governors or trustees should also consider a digital link role on the board.

You should keep a contracts register, an asset register and an information asset register up to date, so you know what you have, what it costs and when licences or hardware need attention. Digital technology should be included in disaster recovery and business continuity plans. Assign the SLT digital lead before you try to write the strategy.

Questions to ask

• Who is our named SLT digital lead, and do governors or trustees have a digital link?
• Are our contracts, asset and information asset registers complete and actually kept up to date?
• Does our digital technology strategy serve the school development plan, rather than a list of leftover projects?
• If systems failed tomorrow, is digital technology — including how we restore it — written into our business continuity and disaster recovery plans?

5. Filtering and monitoring

What it asks for. Schools and colleges have a statutory responsibility to keep children safe online. Governing bodies and proprietors should make sure appropriate filtering and monitoring systems are in place, as set out in KCSIE. The filtering and monitoring standard is the DfE’s recommended approach. You should already be meeting it.

Filtering is preventative: it blocks illegal, inappropriate and potentially harmful content, including text, images, audio, video and AI-generated content. Monitoring is reactive: it watches what users do on devices and can generate alerts. Monitoring might be a teacher looking at screens in a classroom, a technical system, or both. A monitoring system does not, by itself, block access.

Roles must be clear. Governing bodies and proprietors have overall strategic responsibility. They should assign a member of the SLT and a governor to make sure the standard is met, and be clear about the roles of staff and any third-party IT support. The designated safeguarding lead and IT support need to work together, and staff should know how to act on reports and concerns.

You should review filtering and monitoring at least once every academic year, and sooner if you identify a safeguarding risk, change working practice (for example remote access or bring-your-own-device), introduce new technology such as generative AI tools, apply major software updates, or change the technical setup. Reviews should consider whether your solution can handle real-time, dynamic, personalised and AI-generated content.

Filtering must implement the Internet Watch Foundation (IWF) and Counter-Terrorism Internet Referral Unit (CTIRU) blocklists. Your provider should be an IWF member, signed up to CTIRU, and keep those lists up to date. Systems should block harmful and inappropriate content — including illegal child abuse material, unlawful terrorist content and adult content — without unreasonably getting in the way of teaching and learning.

For a closer look at how this sits alongside KCSIE, see our guide to school internet safety, filtering and monitoring.

Questions to ask

• Who on the SLT, and which governor, is responsible for filtering and monitoring — and do the DSL and IT support have a clear way of working together?
• When did we last review the provision, and did that review include generative AI, mobile apps and any bring-your-own-device use?
• Can our provider confirm that IWF and CTIRU blocklists are in place and kept up to date?
• Do staff know what happens when a monitoring alert is raised, and can we identify the person involved so the right support can follow?

6. Cyber security

What it asks for. KCSIE also expects appropriate cyber security measures and procedures. The cyber security standard is the DfE’s recommended approach. It is a shared responsibility for senior leaders and IT support, not a task that can be left with the technician alone.

The current standard includes:

• a cyber risk assessment, conducted annually and reviewed every term, plus a cyber response plan (this is also a condition of cover if you have the DfE’s risk protection arrangement)
• a cyber awareness plan for staff and students, including how to report an incident
• anti-malware and a properly configured firewall, kept on supported firmware and checked termly
• control of user accounts and privileges, including multi-factor authentication (MFA), which must be enabled for all staff accounts with access to cloud services or remote access to on-site systems, and for all IT administrative accounts
• licensed, supported technology, with vulnerability fixes for operating systems, applications and firmware completed within 14 days when the vendor rates the issue as critical or high risk, when it has a CVSS v3.1 score of 7.0 or above, or when the vendor gives no severity rating
• a backup plan that is reviewed at least annually: at least three copies of important data, on at least two separate devices, with at least one copy off-site; immutable backups where possible; and termly testing and logging, including the ability to recover and restore
• a clear process for reporting cyber attacks

Cyber Essentials is a separate, government-backed annual certification. It is required for colleges under their funding agreement. Schools may choose to complete it, and the DfE standards can help you work towards it, but meeting the standard is not the same as holding the certificate.

Antivirus on its own is not the whole picture. We set out why, and what schools should put around it, in School cyber security: why antivirus alone isn’t enough. Atom’s standard security offering is Cynet Protect. Like the free IT audit, it is a way to strengthen your position — it is not a compliance certificate, and it does not guarantee that a school meets the DfE standard.

Questions to ask

• When was our last cyber risk assessment, and is it reviewed every term?
• Is MFA in place for staff cloud and remote access, and for every IT admin account?
• Are critical and high-severity vulnerability fixes applied within 14 days, and is unsupported software flagged at the end of each term?
• Do we have at least three backup copies, with one off-site, and when did we last test a restore?
• Do staff know how to report an incident, and is the response plan actually written down and tested?

The other standards, in brief

Beyond the six core standards, the current manual also includes guidance on:

• cloud solutions
• digital accessibility
• IT support
• laptops, desktops and tablets
• network cabling
• servers and storage

The IT support standard, added in November 2025, asks you to plan, commission and review support so that whoever looks after your technology — internal staff, an external provider, a trust or local authority team, or a mix — helps you meet and maintain the digital and technology standards. The DfE is clear that meeting the standards is a shared responsibility across the school, not something that can be handed over and forgotten.

You should continue to refer to all of the standards, not only the core six. The official manual is the place to do that.

What to do next

Start with the official guidance and, if you have not used it yet, the DfE’s Plan technology for your school service. Use the questions above with your SLT digital lead, DSL, business manager and IT support, and write down what you know, what you do not, and what you will check this term.

If you would like help interpreting the picture, Atom can review your current setup. We review your devices, network, filtering and backups against the DfE digital and technology standards. It is free and helps shape next steps—it is not a compliance certificate or guarantee. The offer is explained on our school ICT support page.

We work with schools in Nottinghamshire and the wider East Midlands. For filtering and monitoring, you may also find our school internet safety and KCSIE page useful, and for the security basics around accounts, patching and backups see why antivirus alone is not enough. When you want to talk it through, contact us.