This is for you if
- A governor, trustee or inspector has asked how your school or trust compares on cyber security
- You are writing a digital strategy or a funding case and need figures you can cite
- You want to know where you stand against the DfE's 2030 ambition for the six core standards
In the 2025/2026 breaches survey, 73% of secondary schools identified a breach or attack, and in the DfE's own survey 21% of primaries and 18% of secondaries met all current digital and technology standards. Most schools sit in the gap between those numbers, and the standards are rarely failed on the technology: they are failed on evidence.
Eleven figures on cyber security in schools, colleges and universities, and on the DfE digital and technology standards in schools, from the Cyber Security Breaches Survey 2025/2026 education findings and the DfE Technology in Schools Survey 2024 to 2025. Each one is quoted exactly, with the source on the tile.
The figures are in the two bands above. Below, the same measures as tick boxes, with the published figure beside each line, so you can give a governor a straight answer on where the school or trust stands. The wording of every figure was re-checked against its source on 5 October 2026.
Where does your school stand?
Tick each line only if you could show the evidence to a governor today. The published figure is beside every line.
1. Cyber security
- We have a policy to apply software security updates within 14 days, and can show it running (secondary schools: 62%)
- Leaders know what Cyber Essentials is and whether we would pass it (aware of it: 57% of secondaries, 20% of primaries)
- We have covered every one of the NCSC's 10 Steps to Cyber Security (primary 14%, secondary 23%, further education 33%)
- Staff have had cyber security training in the last 12 months (leaders providing it: 85%)
2. When it happens
- We have a cyber attack plan, and tested it in the last year (primaries 28%, secondaries 41%)
- We would know about a phishing email that got through, and what was clicked (phishing: 90% of primaries and 96% of secondaries that identified a breach)
3. The standards
- We know where we stand against each of the six core digital and technology standards, with evidence for each (meeting all current standards: 21% of primaries, 18% of secondaries)
- Governors or trustees have seen a dated plan to meet the core standards by 2030
What your ticks add up to
All 8 ticked, with evidence
You are further along than most schools the two surveys counted. Keep the evidence for each line where a governor or an inspector could be shown it.
Five to seven ticked
Ahead of the published figures on most lines. In both surveys the least common are a tested cyber attack plan and coverage of all ten Steps, so check those two first.
Four or fewer ticked
Where most schools are today, with 2030 as the DfE's date for the core standards. A baseline against the standards turns the gaps into a dated plan governors can follow.
Not sure how to answer a line
Treat it as unticked. The standards are rarely failed on the technology; they are failed on evidence nobody can find.
Sources
- 1DSIT and Home Office, Cyber Security Breaches Survey 2025/2026: education institutions findings, published 30 April 2026. www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026-education-institutions-findings
- 2Department for Education, Technology in schools survey report: 2024 to 2025, published 27 November 2025. www.gov.uk/government/publications/technology-in-schools-survey-report-2024-to-2025
Every figure is quoted in the publisher’s own words. The wording and numbers were re-checked against each source on 5 October 2026.
Where this leaves you
All twelve DfE standards, what each one asks for and which carry the 2030 date, are set out in the DfE digital and technology standards, explained. To work through them yourself, use the DfE digital standards checklist. For a governor-ready position statement against all twelve, the DfE digital standards baseline takes 60 minutes, plus a written baseline within five working days. Our work with schools, colleges and trusts starts there.
Frequently asked
Where do the schools figures come from?
The Cyber Security Breaches Survey 2025/2026 education institutions findings, published by the Department for Science, Innovation and Technology and the Home Office on 30 April 2026, and the Department for Education's Technology in schools survey report: 2024 to 2025, published on 27 November 2025, in which 1,634 schools took part. Every figure is quoted in the publisher's own words.
What is the DfE's date for the digital and technology standards?
The DfE's Technology in Schools Survey report describes the ambition for every school to meet the six core digital and technology standards by 2030. In the same survey, 21% of primaries and 18% of secondaries met all current standards, up from 12% and 9% in 2023.