When I first wrote about the DfE’s Meeting digital and technology standards in schools and colleges guidance in 2022, the standards were still being added in batches, and much of the discussion was about what the DfE might publish next. Over the following year, there was a flurry of activity with more and more standards added.
Three years on, the picture is more settled. The guidance is now organised around six core standards that all schools and colleges should be working towards by 2030: broadband internet, cyber security, digital leadership and governance, filtering and monitoring, network switching and wireless networks.
That doesn’t mean things have stood still. The DfE has amended the core standards ten times so far in 2026, mostly in small increments that are easy to miss if you aren’t checking the update log. Individually they look minor. Taken together, they change what “meeting the standard” means in a few important areas, particularly cybersecurity and filtering.
With the new academic year under way, and annual reviews coming up for many organisations, this is a good time to catch up. In this piece, we look at the changes that matter most and what they mean in practice.
The bigger picture
Three changes apply across the standards before we get into the detail.
The first is structural. The six core standards now have their own “core standard” pages, which makes it clearer which requirements carry the 2030 expectation. The other standards, such as cloud, servers and storage, and laptops and tablets, remain in place alongside them. A new IT support standard was also added in November 2025, which we will cover in a future article.
The second is a change of framing, added in September. Both the cyber security and filtering and monitoring standards now open by stating that schools and colleges have a statutory responsibility to keep children and young people safe online, as set out in Keeping children safe in education (KCSIE). The standards themselves are still described as the DfE’s recommended approach. However, tying them explicitly to a statutory safeguarding duty strengthens their standing considerably. In my experience, governors and senior leaders respond very differently to “this is IT best practice” than to “this is how we evidence a safeguarding duty”. That is worth considering when you make the case for strategic importance and investment.
Finally, the emphasis on many of the standards is now more about oversight and governance than purely technical discussions and requirements. This includes the fact that the DfE now expects one SLT member to be the nominated digital lead, with strategic oversight of digital technology and responsibility for the digital strategy. As the move to the standards becoming mandatory in 2030, the fact that these are now SLT obligations rather than the “IT Guy” is something that can’t be overstated.
Cyber security
The cyber security core standard has seen the most technical change this year, largely to bring it into line with the National Cyber Security Centre’s Cyber Essentials 2026 requirements. For colleges, this matters directly, as Cyber Essentials is a requirement under the funding agreement. For schools and academies this reduces the dilemma as to whether to conform to the standards (mandatory from 2030) or strive towards CE (not mandatory. Yet!).
Vulnerability fixes, not just patches. The standard now requires vulnerability fixes for operating systems, applications and firmware to be applied within 14 days of release. That applies where the vendor rates the vulnerability as critical or high, where it has a CVSS v3.1 base score of 7.0 or above, or where the vendor provides no severity rating at all. Importantly, “vulnerability fix” is now defined to include configuration or registry changes and vendor-provided scripts, as well as patches and updates. Where a fix isn’t available, affected devices should be isolated from the network or separated from higher-risk systems and data.
Most teams I work with handle Windows updates well, often automatically. The gaps are usually elsewhere: firmware on switches, access points and firewalls, third-party applications, and the manual workarounds vendors publish before a proper patch is ready. These are exactly the areas the revised wording brings into scope. The “no severity rating” clause also catches a lot of smaller suppliers whose advisories are less formal. If your patching evidence is a Windows update compliance report and little else, now is a good time to broaden it.
Multi-factor authentication. MFA must be enabled for all staff accounts with access to cloud services or remote access to on-site systems, and for all IT administrative accounts. The standard now also recognises passkeys as an alternative where staff use a dedicated device. In most colleges and trusts the gaps are not in Microsoft 365 but in the long tail of other cloud services that were adopted separately, sometimes by individual departments, and never brought under single sign-on. Again this moves closer to the CE requirements where if a service has MFA available it must be used.
Reporting and the Cyber Security Hub. References to Action Fraud have been updated to its new name, Report Fraud, and a link to the DfE’s Cyber Security Hub has been added. Colleges should also note that Jisc’s CSIRT is listed as a reporting route for further education. These are small changes, but it’s worth checking that your cyber response plan, incident contact cards and any printed copies stored off-site have the current names and details. In a real incident, nobody should be searching for the right phone number.
If you haven’t read the cyber standard in full since it was restructured in 2024, a few other requirements are worth rechecking while you’re there. These include immutable backups with termly restore testing, documented and termly-reviewed firewall rules, MFA on firewall administration, and termly account reviews with HR and finance.
Filtering and monitoring and generative AI
The filtering and monitoring core standard has been updated several times this year, and the common thread is generative AI.
The standard now makes clear that filtering should cover AI-generated content, alongside text, images, audio and video. It asks all schools and colleges to consider whether they need a solution that can handle real-time, dynamic, personalised and AI-generated content. The annual review should now cover how and where generative AI tools are used, including AI features built into other applications, and the introduction of new generative AI tools is listed as a trigger for an additional review. Since August, the standard has also pointed organisations to the DfE’s Generative AI: product safety standards whenever they introduce a specific AI product.
This reflects a real technical problem. Traditional filtering works largely at the level of websites and URLs. AI is now built into productivity suites, browsers, search engines and social media apps. Content generated inside an approved application doesn’t look like a visit to a new website, so URL-based filtering has limited visibility of it. In practice, this means:
- asking your filtering provider directly what they can and cannot see in AI-generated and in-app content, and getting the answer in writing
- recognising that device-based monitoring becomes more important where filtering has blind spots
- building the product safety standards into procurement, so that AI tools are assessed before they are bought or switched on, not afterwards
- making sure the DSL is involved, and arguably should lead, in decisions to enable AI features, not just making it an IT matter.
The technical requirements, expanded in January, are also worth rereading. Two points stand out. The IWF and CTIRU blocklists must be implemented in a way that cannot be disabled or altered by anyone, including system administrators. Any temporary exception to filtering, such as for system updates, must be approved and documented by the responsible member of SLT, with the DSL assessing the safeguarding implications. Both are easy to overlook in day-to-day operations.
For colleges, the student risk profile deserves particular thought. A college population typically includes 14 to 16 year olds, 16 to 18 year olds and adult learners, often on the same network. It also usually includes a lot of personal devices. The standard expects BYOD to be filtered and unmanaged devices to sit on a separate virtual network. A single filtering profile for “students” is unlikely to fit that mix well.
Wireless networks and Wi-Fi 7
The wireless core standard was updated in April with two changes that pull in slightly different directions.
When an upgrade is needed, the minimum specification is now Wi-Fi 7 (802.11be). The standard also asks you to consider access point uplink speeds of 1, 2.5, 5 or 10Gbps. Alongside this, the DfE clarified that you only need to upgrade your wireless network when it no longer meets your needs or is unsupported.
That clarification is very welcome. Many colleges and trusts have invested in Wi-Fi 6 or 6E in the last few years, and there is no expectation that working, supported equipment is replaced just to meet the standard. I’d be cautious of any supplier suggesting otherwise.
Where a refresh is due, Wi-Fi 7 should be the specification, but the access points are only part of the cost. Higher uplink speeds need multi-gigabit switch ports, the newer access points typically need more power over Ethernet, and older cabling may limit what you actually get. In my experience, the most common budgeting mistake in wireless projects is pricing the access points and discovering the switching and cabling costs later. It’s much better to plan wireless, switching and cabling together, which also lines up with the network switching core standard. The standard also expects WPA3, network segregation, quality of service configuration and heat mapping as part of the design.
Of course, technology doesn’t stand still, and Wi-Fi 8 products are already hitting the market but, as noted above, calls from vendors to say that this is the must-have technology now should be strongly resisted.
What to do now
If you want a short list of practical actions from this year’s changes, I’d suggest:
- Check that you have SLT responsibility and buy-in that the standards are important and not a nice-to-have. I have been talking about these standards for 4 years but still come across colleges and academies who are not even aware of their existence.
- Check your patching process and evidence against the 14-day requirement, including firmware, third-party applications and non-patch fixes.
- Audit MFA across all cloud services and administrative accounts, not just the main productivity platform.
- Update your cyber response plan and incident contacts for Report Fraud, the DfE sector cyber team and, for colleges, Jisc.
- Ask your filtering provider how they handle AI-generated and in-app content, and add generative AI to your filtering and monitoring review.
- Build the DfE’s generative AI product safety standards into your procurement and approval process.
- Use your next wireless refresh to plan wireless, switching and cabling together, rather than replacing working equipment early.
- Use the KCSIE framing when presenting cyber and filtering risks to governors.
Final thoughts
None of this year’s changes is dramatic on its own, and that is part of the challenge. The standards are becoming a living document, updated little and often, and it’s easy to fall behind if nobody is tracking the change log. For most colleges and academy trusts, the practical answer is to make a review of the latest updates a fixed part of the annual digital strategy review, so that changes are picked up in one go rather than discovered during an audit or an incident.
If you’d like help assessing where you stand against the latest standards, or support with planning the work needed to meet the core standards by 2030, please get in touch.
0 Comments