Digital leadership and governance: the DfE standard most schools skip, and why it comes first

Every other DfE standard assumes that somebody in your school owns digital technology, knows what you have, and has a plan for it. This is the standard that creates that person, those records and that plan, and it is the one most schools have never formally closed.

In short: The DfE's digital leadership and governance standard asks schools and colleges to do four things, in order: assign a senior leadership team member as the SLT digital lead; keep a contracts register, an asset register and an information asset register up to date; include digital technology in disaster recovery and business continuity plans; and write a digital technology strategy covering at least two years, reviewed every year. It is one of the six core standards schools should be working towards by 2030. The first step costs nothing: the headteacher or principal names the digital lead.

Why the DfE puts this standard first

The governance standard contains no technology at all. Nothing to buy, no speeds, no cabling categories. What it asks for is a named owner, three records, a plan for the bad day, and a strategy for the good ones.

The DfE also makes it explicitly sequential. The page says you "will need to assign the role of the SLT digital lead within your school or college before you can create your digital technology strategy", and the fourth requirement opens with "Before you review this standard, make sure you complete the first 3 standards in this topic".

That sequencing reaches beyond this one page. The cyber security standard makes the SLT digital lead accountable for all seven of its requirements. The devices and IT support standards both expect a digital strategy to exist. It is also the cheapest core standard to meet and, from the pattern we see in IT estates generally, the one most often missing entirely.

What does the standard actually ask for?

The DfE standard is four requirements, listed here in the DfE's order:

• "Assign a senior leadership team (SLT) member to be responsible for digital technology". The headteacher or principal appoints someone who "does not need to be an expert", usually a person with teaching experience.
• "Keep registers relating to hardware and systems up to date". Three registers: contracts, assets and information assets.
• "Include digital technology within disaster recovery and business continuity plans". Either inside your existing plans or as a separate digital plan, reviewed annually.
• "Have a digital technology strategy that is reviewed every year". A minimum two-year strategy, completed before your next budget cycle.

The full wording is on the GOV.UK page for the digital leadership and governance core standard. Our DfE standards guide sets it alongside the other eleven.

Who needs to be involved?

The DfE is specific about who holds each part, and it is not the IT technician.

• The headteacher or principal is responsible for making sure the standard is met, by assigning the SLT digital lead.
• The SLT digital lead is accountable for delivery of the strategy, encouraging the use of digital technology, reviewing the effectiveness of IT support, and identifying training needs for staff and students.
• Governors or trustees "should also consider assigning a digital link role within the governing body or board of trustees". They review, support and challenge the plans and the strategy, and sign off where required.
• The data protection officer owns the information asset register.
• IT support, in-house or external, keeps the technical detail of the registers current and feeds the strategy.

The digital lead is a leadership role with technical input, not a technical role with a title.

The three registers and the DfE templates

Most of the work sits here, and the DfE provides a free template for each of the three registers.

• Contracts register. Licences, subscriptions, broadband, IT support and other technology contracts, an approved apps list, and contract values. The business or finance team keeps the commercial information current and IT support keeps the technical information current. The DfE says "This contract register must be kept up to date."
• Asset register. Every piece of equipment, with asset and serial numbers, who it is assigned to, location, purchase date, age, review date and secure disposal date. The SLT digital lead owns it and is responsible for making sure processes are in place for IT support to keep it up to date.
• Information asset register (IAR). "A log of the digital data that is held on staff and students", owned by the data protection officer.

The DfE's timing is practical. You "should already be updating your registers every time something changes", and the digital lead should review them "ahead of your next financial planning cycle" and before moving on to the strategy.

The pattern we see in most estates is not a missing register but three partial ones: a spreadsheet from a previous technician, a finance system that knows the contract value but not the renewal date, and a DPO record completed once and not since. Keeping them reconciled is part of what a managed IT service is for.

Digital technology in your disaster recovery and business continuity plans

The DfE notes that "Insurance companies may ask all schools and colleges for these documents as part of risk management", so "you should already be meeting this standard or be working towards meeting it".

You can include digital technology in your existing business continuity and disaster recovery plans, or keep a separate digital plan. Either way, both plans "need to be reviewed and updated annually or when a significant change occurs". Beyond that, the standard asks for:

• A top-level summary document of key contacts, shared securely with all staff.
• Copies "printed out to retain hard copies in case of an emergency, such as a cyber incident", and "kept online in a secure, shared folder location in the cloud" with remote access for the disaster recovery team.
• A disaster recovery plan that defines what a disaster means for you, in terms of how long you can function without systems, names the DR team and contacts, and says how the plan is tested, for example by simulating data loss or hardware failure.
• Testing "annually (at a minimum)".
• A business continuity plan that assesses digital risks, the steps that reduce them, and the recovery actions.

The annual test only means something if the backup behind it can actually be restored. The instruction to print a hard copy is not old-fashioned either: in a ransomware incident, the shared drive holding your recovery plan is often the first thing you lose.

What the two-year strategy needs to contain

The fourth requirement can only start once the first three are done. The DfE then says it "can be completed before your next budget cycle", a useful deadline for the diary.

The standard describes two stages. First, understand where you are: the school development plan, the contracts and assets in your registers, current and committed spend, the risks in your DR and BC plans, what technology students have at home, and training needs. Then develop a longer-term vision that "should support the school or college's development plan and educational vision, should be sustainable and minimise the impact on the environment".

From that vision, the digital lead "should create a minimum 2-year strategy", then "revisit and review the strategy annually (at a minimum)" and "share a top-level summary of the strategy to key stakeholders". The DfE expects broad input:

• Subject leaders, teaching and learning leads, heads of year and exam officers.
• IT support and the operational team.
• The designated safeguarding lead, the data protection officer and the SEND lead.
• Governors, the school board or trustees, who "support and challenge" the result.

A two-year strategy is also what turns the other standards from a cost shock into a schedule, with the disruptive work placed in the holidays where it belongs.

Where schools usually fall short

None of this is hard. It is the kind of work that never becomes urgent until someone asks for it in writing. The gaps cluster in the same places:

• A digital lead exists in practice but was never formally assigned, so nothing is written down and nobody is accountable to governors for it.
• The asset register lives in the head of the technician who left in July.
• Contracts renew automatically because the renewal date was never recorded, which is also what the cyber security standard asks you to review each term.
• The disaster recovery plan exists, but has never been tested, and the only copy is on the server it describes losing.
• There is a vision statement about digital learning, but no dated, costed two-year strategy behind it.

The fix is sequence, not spend. Name the lead this term. Reconcile the three registers with the DfE templates before the next financial planning cycle. Test the DR plan once. Write the strategy before the budget is set. Where to start with the DfE standards sets out the order for the whole series.

Where Systech fits

We are a Microsoft-first managed IT provider working with schools, colleges and trusts as well as businesses. On this standard our role is the technical half: building and maintaining the asset and contracts registers from live inventory data, supplying the network and recovery detail the DR and BC plans need, running the annual restore test with you, and giving the SLT digital lead an honest picture of the estate to build a strategy on.

We do not appoint your digital lead, own your information asset register or write your educational vision. Those belong to the school. What we can do is make sure the records behind them are accurate, current and evidenced.

The quickest way to find out where you stand is our free 60-minute DfE standards baseline. You get a written view of the six core standards, this one included, and the findings are yours whether or not you work with us afterwards.