Part 9 of 13 in Meeting the DfE digital and technology standards.
Most schools moved to the cloud years ago without ever deciding to. Email went first, then files, then the MIS. The DfE cloud standard is the moment to look at what accumulated and ask whether it is secured, backed up and controlled the way the paperwork now expects.
In short: The DfE cloud solutions standard asks schools and colleges to use cloud services instead of local servers as soon as possible, to make sure every cloud service follows data protection legislation with a DPIA and UK or EU data residency, to run one central identity system that is the only way staff and pupils log on, to check published availability targets before signing, and to keep 3-2-1 backups of critical data. It is not a core standard and has no 2030 date; the DfE says two parts should already be met. For a Microsoft school, most of it is configuration of licences you already hold.
What does the cloud standard ask for?
The DfE defines cloud solutions as services "hosted and managed on the internet rather than locally in the school", accessible "from a wide range of devices at anytime from anywhere with an internet connection." Its cloud solutions page sets out five standards, in this order.
- "Use cloud solutions as an alternative to locally-hosted systems, including servers"
- "Cloud solutions must follow data protection legislation"
- "Cloud solutions should use ID and access management tools"
- "Cloud solutions should work on a range of devices and be available when needed"
- "Make sure that appropriate data backup provision is in place"
Each one carries its own timing, which is where the standard is easy to misread. Cloud is not one of the six core standards on the DfE standards hub, so the 2030 target does not apply to it. But three of the five parts use stronger language than "by 2030".
When do you have to meet it?
Read the five "when to meet" lines together and a priority order falls out of them.
- Data protection (standard 2): "You should already be meeting this standard in accordance with data protection legislation."
- Backups (standard 5): "You should already be meeting this standard to help safeguard, protect and secure your data and systems."
- Cloud instead of servers (standard 1): "You should meet this standard as soon as possible to realise the benefits."
- ID and access management (standard 3): "You should meet this standard as soon as you can."
- Devices and availability (standard 4): applies "for existing and new cloud solutions", so it is a procurement discipline rather than a project.
So the two parts a governor should ask about first are the two the DfE says should already be in place: data protection and backups. Neither needs a migration. Both need evidence.
Cloud instead of servers, and what "portable" means
The first standard is the one with the biggest long-term effect on a school's budget. The DfE says "using cloud solutions reduces the need for local servers", which can "support your overall school strategy" and "allow you to take advantage of low-cost or free cloud services." The servers and storage standard repeats the same sentence, which tells you how the DfE expects the two to be read together.
The how-to-meet guidance is practical. Understand what software, devices and data you have and what each is used for. Ask IT support about free cloud services. Assess where servers can be replaced. Train users. The technical requirement that catches schools out is data portability. The standard asks that data can leave the service as easily as it arrived:
- secure, encrypted transfer,
- export to open or common formats,
- secure, documented APIs,
- timely transfer of data when a contract ends.
That last point is the one to write into every new contract before it is signed. A cloud service that holds ten years of pupil records and offers no export route is a lock-in, not a solution.
Data protection, residency and the NCSC principles
The second standard is the only one of the five the DfE phrases with "must", because it rests on the law rather than on guidance: "You must comply with data protection legislation." The how-to-meet section lists what that looks like for a cloud service.
- A DPIA from your DPO "for any cloud solutions that store personal and or sensitive personal data."
- Extra controls for personal and sensitive data: encryption, password protection and restricted access.
- Third-party processing under contract, with a data sharing agreement with the provider and breach roles documented.
- A process for creating, approving and removing user accounts.
- The NCSC cloud security principles: "All systems need to follow the National Cyber Security Centre (NCSC) cloud security principles."
- Residency: "Data should be stored and processed in the UK or EU, unless you have confirmed that any international transfer complies with UK GDPR."
The pattern we see is not schools ignoring this. It is schools with a DPIA for the MIS and nothing for the twelve smaller services teachers signed up for with a school email address. The list of cloud services is the first thing to build, and the contracts register from the governance standard is where it belongs.
"The cloud service you have not written down is the one that will fail the audit."
One identity, with a back door only IT support holds
The third standard is the one that quietly fixes most of the others. The DfE says that "to meet your data protection and safeguarding obligations, you should use a central ID and access management tool", chosen once and used "for all current and future cloud solutions." For a Microsoft school that tool is Entra ID, which comes with the Microsoft 365 Education tenancy the school already runs.
The technical requirements are specific and worth checking against your own tenancy.
- Test the ID system with all the systems it will connect to.
- It should be the only way staff and students log on. Services with their own separate passwords are the gap.
- Documented add and remove processes, so leavers lose access on the day they leave.
- Role-based access levels, so a teaching assistant and a business manager do not hold the same rights.
- IT support retains separate, secure access that does not depend on the ID system, so a fault in it cannot lock everyone out.
That last point is the one most often missing. If the only global administrator account is also somebody's daily login, protected by the same policies as everyone else, there is no break-glass route when those policies misfire.
The cyber security standard asks for MFA on staff cloud accounts and admin accounts; the cloud standard asks that the admin route survives on its own. Both are settings, not purchases. The DfE also notes that its "get help buying for schools" service can help with buying ID management tools if you need one.
How much downtime is acceptable?
The fourth standard asks schools to understand how and when a service needs to be accessed before signing, to check that the provider's published availability targets meet those needs, and to trial the service before committing. The DfE translates the percentages into time, and the table is worth keeping.
| Published availability | Downtime the DfE says that allows |
|---|---|
| 99% | approximately 7 hours per month |
| 99.9% | approximately 45 minutes per month |
| 99.99% | approximately 5 minutes per month |
Seven hours a month is a lesson a week. Forty-five minutes is an inconvenience. Five minutes is invisible. Which tier a service needs depends on what it is for, and the answer for the learning platform is not the answer for the catering system. The standard also asks for easy but secure access from a range of devices, which ties back to the ID system above: one login, on any device, with the same protections.
Backups: the 3-2-1 rule for cloud data
The fifth standard corrects the most common assumption about cloud services. The DfE says "the most common risk of cloud data loss is accidental or deliberate data deletion by users", not provider failure. The provider keeps its platform running; it does not promise to keep the file a pupil deleted last term.
The how-to-meet guidance asks you to:
- understand the provider's own backup processes: what is backed up, where, for how long and how often,
- decide the provision for each solution based on sensitivity, importance, impact, tolerable outage and cost,
- for critical data, "use the 3-2-1 rule, at least 3 copies, on 2 devices and 1 offsite,"
- use third-party backup solutions or plug-ins "where the cloud service does not meet needs."
For Microsoft 365 that usually means a separate backup of mail, OneDrive, SharePoint and Teams held outside the tenancy, with a restore test on the calendar. The DfE adds one dependency here: "Check that you meet the servers and storage standards for schools and colleges." Any server still on site needs the same rule applied.
Where Systech fits
We are a Microsoft-first team, and most of this standard is work inside a tenancy a school already pays for: Entra ID as the single sign-on for every cloud service, a documented joiner and leaver process, role-based access, a protected break-glass account, and a third-party Microsoft 365 backup with restore tests we can evidence. We help the DPO build the cloud service register and the DPIAs behind it, and we plan server retirements into holidays rather than term time. We do not act as your DPO, and the residency and contract questions on non-Microsoft services stay with the school; we give you the checklist and the findings to put in front of them.
If you would like to know where your school stands against this standard and the eleven others, our free 60-minute DfE standards baseline works through each one with you and leaves you with the findings in writing, whether or not you go any further with us.
Frequently asked
What does the DfE cloud solutions standard require of schools?
The DfE cloud solutions standard has five parts. Schools and colleges should use cloud solutions as an alternative to locally hosted systems, including servers, and the DfE says to meet that part as soon as possible. Cloud solutions must follow data protection legislation, which means a DPIA from your DPO for any service holding personal data, the NCSC cloud security principles, and data stored and processed in the UK or EU unless an international transfer has been confirmed to comply with UK GDPR. Cloud solutions should use a central ID and access management tool that is the only way staff and students log on. They should work on a range of devices and be available when needed, with published availability targets checked before signing. And appropriate backup provision should be in place, using the 3-2-1 rule for critical data.
Does Microsoft 365 count as meeting the DfE cloud standard?
Microsoft 365 is a cloud solution in the DfE's sense: hosted and managed on the internet rather than locally, and accessible from a range of devices. Having it does not by itself meet the standard, because the standard is about how cloud services are chosen, secured and run rather than which product you buy. A school on Microsoft 365 still needs a DPIA for the personal data it holds, confirmation of where that data is stored, a documented process for creating and removing accounts, role-based access, a single sign-on identity for every other cloud service, and a backup arrangement that meets the 3-2-1 rule for critical data. Most of those are configuration and paperwork on a licence the school already pays for, which is why the gap is usually smaller than it first appears.
What does 99.9% availability actually mean for a school?
The DfE cloud standard gives the translation directly. A service with 99% availability can be down for approximately 7 hours a month. At 99.9% that falls to approximately 45 minutes a month, and at 99.99% to approximately 5 minutes a month. The standard asks schools to understand how and when a solution needs to be accessed before signing, to make sure the provider's published availability targets meet those needs, and to trial the service before committing. A learning platform used in every lesson has a different tolerance from a system the office uses once a week, so the right tier depends on the service, not on the headline number. The figures are also worth reading against the broadband standard, since a cloud service is only as available as the connection to it.
Do schools need a separate backup for Microsoft 365 or Google Workspace?
The DfE cloud standard says the most common risk of cloud data loss is accidental or deliberate deletion by users, and asks schools to understand what the provider backs up, where, for how long and how often, then decide the provision for each solution based on sensitivity, importance, the impact of loss, the outage the school can tolerate and cost. For critical data it asks for the 3-2-1 rule: at least three copies, on two devices, with one off-site. Where the cloud service's own retention does not meet those needs, the standard points to third-party backup solutions or plug-ins. For most schools that means a separate backup of email, files and shared drives held outside the provider's own tenancy, with a restore test to prove it works.
