The DfE IT support standard: what good support looks like, and how to review yours

Every school has IT support of some kind. The DfE's question is whether it can get you to the other eleven standards, and whether anyone has written down what it is expected to do.

In short: The DfE defines IT support as "the person or team responsible for making sure your school or college's digital technology works reliably, is secure and stays up to date", whether internal, external or hybrid. The standard asks five things: IT support helps you meet the digital and technology standards; it maintains and improves your technology in line with your strategy; it is responsive and meets agreed expectations; you review it yearly, in writing, shared with governors; and staff get clear guidance and training. The DfE says you should already be meeting this or working towards it. The first step is a written record of every IT support service you use, who provides it and what it covers.

What does the standard actually ask for?

The definition on the IT support page on GOV.UK is deliberately broad: internal, external or hybrid, with no preference. The stakes are put plainly: "Without effective IT support, your school or college is more vulnerable to risks, such as outages and cyber security incidents." There is no minimum team size, no required contract and no named framework. Five requirements, in the DfE's order:

• "Make sure IT support helps you meet the digital and technology standards"
• "Make sure IT support actively maintains and improves your digital technology in line with your digital strategy"
• "Make sure your IT support is responsive and meets agreed service expectations"
• "Review your IT support at least once a year"
• "Make sure staff get clear guidance and training on using technology"

The first is the umbrella. The DfE says "IT support should make sure that their daily activities and planning decisions help you meet and stay compliant with the digital and technology standards", and the SLT digital lead should make sure the standards inform the strategy and the school development plan.

On qualifications, the SLT digital lead "should assess whether your IT support needs any relevant professional memberships or certifications". The DfE's own examples are an ITIL certification for individuals and Cyber Essentials certification for companies. It is an assessment the school makes, not a rule the DfE imposes.

When do you have to meet it?

This is not a core standard and has no 2030 date, but the wording is closer to "now" than most non-core pages:

• Helping you meet the standards: "You should already be working towards meeting the digital and technology standards."
• Maintaining and improving: "you should already be meeting this standard or working towards it".
• Responsive and agreed expectations: the same wording.
• The annual review: "Carry out this review each year alongside your school or college's wider digital strategy review."
• Training: "You should already have training and guidance in place."

The DfE's free plan technology for your school service is named on this page as the way to measure progress, and it is worth using before any review meeting.

What "maintains and improves" covers

The second requirement is the closest thing the DfE gives to a job description. The SLT digital lead works with the business manager and other SLT members to establish what support is needed, using the registers and the digital technology strategy from the governance standard. The maintenance list:

• Monitor the network, devices and cloud services.
• Patching, firmware updates and health checks.
• Resilience against cyber attack, and "making sure all critical data and systems are backed up, and that backups are secure and restorable".
• Working with the DSL on filtering and monitoring.
• Account management and day-to-day requests.
• Keeping the registers current and feeding licence and contract information to finance.
• Identifying replacement needs and budget implications, and evaluating new technology.

Two lines are worth pinning to the wall. "If any of your IT support is provided by third parties, your internal IT support should coordinate their activity." And: "Keep an up-to-date record of all IT support services your school or college uses, including who provides them and what they cover." Most schools have several providers, for the MIS, the broadband, the filtering and the printers, and nobody holds the list.

The DfE's reasons are practical: support should help you "meet statutory duties, including data protection regulations", and keep technology "working reliably, even at busy times". The backup and patching items overlap with the cyber security standard, so one piece of evidence can serve both.

What "responsive" means when the DfE gives no numbers

The DfE gives no response or resolution times. Instead, the SLT digital lead "should set and agree expectations for how IT support will respond to and resolve issues", with teaching-and-learning and core systems prioritised higher and an escalation route recorded.

The sizing question it offers is the useful one: "Consider how long your school or college could continue to operate if a critical system was unavailable. Use this to inform what level of support and response time you need to ensure business continuity." The rest is channels and records:

• "multiple ways to raise requests, such as phone, email and in person"
• "clear operating hours, including support during school hours and arrangements for emergency cover"
• "self-service options for common issues"
• "Staff should avoid making support requests through unofficial channels, such as instant messages."
• "If you use external suppliers for IT support, check your contract to understand the service levels they're required to provide."
• Record and track every request, its priority and its actions. The DfE says to "Consider using a case management or helpdesk system", and to report to governors in the yearly review.

On capacity, the DfE asks you to review the records for peaks such as the start of the year and exam periods, and to "consider a hybrid approach where your existing IT support is supplemented by specialist providers". September is the busiest support period in any school, and an agreement that ignores it breaks by the second week.

What the annual review has to contain

The fourth requirement turns support from something that happens to you into something you govern. The SLT digital lead leads it, working with IT support staff or the provider, staff feedback, the business manager and headteacher on budgets, and governors or the trust board on findings and major decisions. What it covers:

• The type of support in place, and the record of all services used.
• Upcoming needs, skills and capacity, and budget.
• The year's request records and feedback: peaks, problem systems and training needs.
• Contracts and procurement, and value for money.

On the last point the DfE is explicit: "Value for money does not necessarily mean the lowest cost." It names its own get help buying for schools service for impartial procurement advice. And the output is a document: "Your SLT digital lead should summarise the review findings in writing. Share this with your SLT, business manager and governors or trust board." That summary is the single thing a governor is most likely to ask for.

Training, induction and the cyber link

The fifth requirement is the one most often assumed rather than done. The DfE says "All new staff should receive induction training when they join or change roles, followed by regular refresher training." The topics named are the MIS, safeguarding and behaviour platforms, parental communication tools, and "the cyber security awareness training set out in the digital and technology standards on cyber security". Beyond induction, the DfE asks for:

• Plain-English guidance for logging in, password resets, common problems and raising requests, published where staff can find it.
• Materials kept current for new technology, with generative AI tools named as an example.
• Regular training for IT support staff themselves, including on the cyber security and business continuity plans.
• Technical documentation behind the BC and DR plans, and help developing data protection, cyber security and acceptable use policies.

The DfE's reason is blunt: "Without adequate training and guidance materials, technology may be underused or misused. Inadequate training or guidance can also create safeguarding and data protection risks."

Internal, external or hybrid: how to choose fairly

The DfE names all three models and endorses none. An internal technician knows the building and the staff, and is there at 8.30 when the whiteboards fail. An external provider brings depth across specialisms, cover for absence, and a helpdesk with records built in. The DfE's capacity advice points at the hybrid.

Whichever you choose, the five requirements are identical. The fair comparison is not the price; it is which model can produce the record of services, the agreed expectations, the request history, the written review and the training log. We set the models side by side in managed IT vs in-house vs break-fix and MSP vs internal IT, and our guide to how to choose an IT support company lists the questions worth asking any provider, including us.

Where Systech fits

We provide managed IT support to schools, colleges and trusts, either as the whole service or as the specialist layer alongside an internal technician, which is the hybrid the DfE describes. What we bring to this standard is the machinery: a helpdesk that records every request, patching and backup evidence that also serves the cyber standard, the registers kept current, and an annual written review pack in the form the DfE asks for.

We are one of the three models the DfE describes, not the only one. We do not replace your SLT digital lead's decisions, we do not certify Cyber Essentials ourselves, and the safeguarding response stays with your DSL. What we own is making sure the evidence exists.

Our free 60-minute DfE digital standards baseline covers IT support alongside the other eleven standards, and the findings are yours whether you work with us, keep your provider or stay in-house. The standards guide collects the series. And if the first question is whether you are allowed to buy support from a provider like us without a framework, how schools and trusts buy IT support sets out the DfE's value bands and what we provide at each.