# data[].attributes.headline
Monitoring and Filtering Guidance for Governors and Trustees

# data[].attributes.subject
Monitoring and Filtering Guidance for Governors and Trustees

# data[].attributes.attachment_link.readable_text
Skip to main content

Cookies on GOV.UK

We use some essential cookies to make this website work.

We'd like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services.

We also use cookies set by other sites to help us deliver content from their services.

You have accepted additional cookies. You can change your cookie settings at any time.

You have rejected additional cookies. You can change your cookie settings at any time.

Accept additional cookies Reject additional cookies View cookies

Statutory guidance for schools and colleges on safeguarding children and safer recruitment.

Details

This guidance applies to all schools and colleges and is for:

headteachers, teachers and staff

governing bodies, proprietors and management committees

It sets out the legal duties you must follow to safeguard and promote the welfare of children and young people under the age of 18 in schools and colleges.

All school and college staff should read part 1 of this guidance. Part 1 of the guidance is also available as a standalone document.

Statutory guidance sets out what schools must do to comply with the law.

Where the guidance states schools and colleges should do something, you should follow this unless you have a good reason not to.

'Regulated activity in relation to children: scope' describes work that a barred person must not do. We have also published guidance on disqualification under the Childcare Act 2006.

# data[].attributes.attachment_link.description
Statutory guidance for schools and colleges on safeguarding children and safer recruitment.

# data[].attributes.attachment_link.readable_text
This non-statutory guidance outlines how schools can ensure their pupils understand how to stay safe and behave online as part of existing curriculum requirements.

It complements existing subjects including:

There are no additional teaching requirements.

This guidance is for school leaders, school staff and governing bodies. It applies to all local-authority-maintained schools, academies and free schools.

Independent schools and non-maintained special schools may also find this guidance helpful as they are required to teach relationships education, relationships and sex education, and health education.

Introduction

Today's pupils are growing up in an increasingly complex world, living their lives seamlessly on and offline. This presents many positive and exciting opportunities, but also challenges and risks.

We want schools to equip their pupils with the knowledge needed to make the best use of the internet and technology in a safe, considered and respectful way, so they are able to reap the benefits of the online world.

This advice brings together information that will help schools deliver online safety content within their curriculum and embed this within their wider whole school approach.

Refer to the education for a connected world framework for age-specific advice about the online knowledge and skills that pupils should have the opportunity to develop at different stages of their lives.

Curriculum context

As part of the statutory relationships and health education in primary schools and relationships, sex and health education in secondary schools, pupils are taught about online safety and harms. This includes being taught:

Throughout these subjects, teachers will address online safety and appropriate behaviour in an age-appropriate way that is relevant to their pupils' lives.

This complements the computing curriculum, which covers the principles of online safety at all key stages, with progression in the content to reflect the different and escalating risks that pupils face. This includes:

how to use technology safely, responsibly, respectfully and securely

where to go for help and support when they have concerns about content or contact on the internet or other online technologies

There are also other curriculum subjects which include content relevant to teaching pupils how to use the internet safely. For example, citizenship education explores:

Educate Against Hate has a full teaching pack dedicated to fundamental British values that includes class tasks, a class presentation, films and teaching guidance.

You should consider what you are already delivering through the curriculum, and build in additional teaching as required to make sure pupils know how to stay safe and how to behave online.

Underpinning knowledge and behaviours

The online world develops and changes at a great speed. New opportunities, challenges and risks are appearing all the time. This can make it difficult for schools to stay up to date with the latest devices, platforms, apps, trends and related threats.

It is important to focus on the underpinning knowledge and behaviours that can help pupils to navigate the online world safely and confidently regardless of the device, platform or app. This teaching could be:

Teaching must always be age and developmentally appropriate.

How to evaluate what they see online

Covering this content will enable pupils to make judgements about what they see online and not automatically assume that what they see is true, valid or acceptable.

You can help pupils to consider:

whether a website, URL or email is fake

what cookies do and what information they are sharing

if a person or organisation is who they say they are

why a person wants them to see, send or believe something

why a person wants their personal information

the reason why something has been posted

whether something they see online is fact or opinion

How to recognise techniques used for persuasion

Covering this content will enable pupils to recognise the techniques that are often used to persuade or manipulate others.

You can help pupils to recognise:

Online behaviour

Covering this content will enable pupils to understand what acceptable and unacceptable online behaviour look like. You should teach pupils:

that the same standard of behaviour and honesty apply on and offline, including the importance of respect for others

to recognise unacceptable behaviour in others

You can help pupils to recognise acceptable and unacceptable behaviour by:

looking at why people behave differently online, for example how anonymity (you do not know me) and invisibility (you cannot see me) affect what people do

looking at how online emotions can be intensified resulting in mob mentality

looking at the key principles behind a constructive discussion, including a willingness to listen to other opinions and a readiness to be educated on a topic

considering how to demonstrate empathy towards others (on and offline)

teaching techniques (relevant on and offline) to defuse or calm arguments, for example, a disagreement with friends, and disengage from unwanted contact or content online

considering unacceptable online behaviours often passed off as so-called social norms or just banter, for example, negative language being used as part of online gaming but would never be tolerated offline

How to identify online risks

Covering this content will enable pupils to identify possible online risks and make informed decisions about how to act. This should not be about providing a list of what not to do online. The focus should be to help pupils assess a situation, think through the consequences of acting in different ways and decide on the best course of action.

You can help pupils to identify and manage risk by discussing:

How and when to seek support

Covering this content will enable pupils to understand safe ways in which to seek support if they are concerned or upset by something they have seen online.

You can help pupils by explaining how to:

You should link this to wider school policies and processes around reporting of safeguarding and child protection incidents and concerns to school staff. Refer to keeping children safe in education for more information.

The online media literacy strategy sets out that the government will give internet users the knowledge and skills they need to make informed and safe choices online.

It sets out 5 principles to underpin delivery of media literacy education. These include understanding:

A list of media literacy resources for teachers and parents is available.

Teaching about harms and risks

Understanding and applying knowledge and behaviours will provide pupils with a solid foundation to navigate the online world in an effective and safe way. By understanding the risks that exist online, you can tailor your teaching and support to the specific needs of your pupils.

This section will help you understand some of the issues your pupils may be facing and where these could be covered within the curriculum. You should consider when it might be appropriate to cover these individual harms and risks.

Any activity that does look at individual harms and risks should be considered in the broader context of providing the underpinning knowledge and behaviours.

This section covers various technical aspects of the internet that could leave pupils vulnerable if not understood.

Age-specific advice on these potential harms and risks can be found in the following sections of the education for a connected world framework:

Age restrictions

Some online activities have age restrictions because they include content which is not appropriate for children under a specific age.

Teaching could include:

You could cover this content in the following curriculum areas:

How content can be used and shared

Knowing what happens to information, comments or images that are put online.

Teaching could include:

what a digital footprint is, how it develops and how it can affect future prospects such as university and job applications

how cookies work

how content can be shared, tagged and traced

how difficult it is to remove something a user wishes they had not shared

the risk of identity theft or targeted approach from fraudsters using information shared online

ensuring pupils understand what is illegal online, for example:

youth-produced sexual imagery (sexting)

sharing illegal content such as extreme pornography or terrorist content

the illegality of possession, creating or sharing any explicit images of a child even if created by a child

You could cover this content in the following curriculum areas:

Disinformation, misinformation, malinformation and hoaxes

Some information shared online is accidentally or intentionally wrong, misleading, or exaggerated.

Teaching could include:

disinformation and why individuals or groups choose to share false information in order to deliberately deceive

misinformation and being aware that false and misleading information can be shared inadvertently

malinformation and understanding that some genuine information can be published with the deliberate intent to harm, for example releasing private information or photographs (including revenge porn)

online hoaxes, which can be deliberately and inadvertently spread for a variety of reasons

explaining that the viral nature of this sort of content can often appear to be a stamp of authenticity and therefore why it is important to evaluate what is seen online

how to measure and check authenticity online

the potential consequences of sharing information that may not be true

You could cover this content in the following curriculum areas:

Fake websites and scam emails

Fake websites and scam emails are used to extort data, money, images and other things that can either be used by the scammer to harm the person targeted or sold on for financial, or another gain.

Teaching could include:

You could cover this content in the following curriculum areas:

Fraud (online)

Fraud can take place online and can have serious consequences for individuals and organisations.

Teaching could include:

what identity fraud, scams and phishing are

explaining that online fraud can be highly sophisticated and that anyone can be a victim

how to protect yourself and others against different types of online fraud

how to identify 'money mule' schemes and recruiters

the risk of online social engineering to facilitate authorised push payment fraud, where a victim is tricked into sending a payment to the criminal

the risk of sharing personal information that could be used by fraudsters

explaining that children are sometimes targeted to access adults' data, for example, passing on their parent or carer's bank details, date of birth or national insurance number

what good companies will and won't do when it comes to personal details, for example, a bank will never ask you to share a password or move money into a new account

how to report fraud, phishing attempts, suspicious websites and adverts

You could cover this content in the following curriculum areas:

Password phishing

Password phishing is the process by which people try to find out your passwords so they can access protected content.

Teaching could include:

You could cover this content in the following curriculum areas:

relationships education core content (all stages) - online relationships topic

computing (all key stages)

Personal data

Online platforms and search engines gather personal data. This is often referred to as 'harvesting' or 'farming'.

Teaching could include:

You could cover this content in the following curriculum areas:

Persuasive design

Many devices, apps and games are designed to keep users online for longer than they might have planned or desired.

Teaching could include:

explaining that the majority of games and platforms are businesses designed to make money - their primary driver is to encourage users to be online for as long as possible to encourage them to spend money (sometimes by offering incentives and offers) or generate advertising revenue

how designers use notifications to pull users back online

You could cover this content in the following curriculum areas:

health education core content (all stages) - internet safety and harms topic

computing (all key stages)

Privacy settings

Almost all devices, websites, apps and other online services come with privacy setting that can be used to control what is shared.

Teaching could include:

how to find information about privacy setting on various sites, apps, devices and platforms

explaining that privacy settings have limitations, for example, they will not prevent someone posting something inappropriate

You could cover this content in the following curriculum areas:

relationships education core content - online relationships topic

computing (all key stages)

Targeting of online content (including on social media and search engines)

Much of the information seen online is a result of some form of targeting.

Teaching could include:

You could cover this content in the following curriculum areas:

How to stay safe online

This section covers elements of online activity that could adversely affect a pupil's personal safety or the personal safety of others online.

Age-specific advice on these potential harms and risks can be found in the following sections of the education for a connected world framework:

Abuse (online)

Some online behaviours are abusive. They are negative in nature, potentially harmful and in some cases can be illegal.

Teaching could include:

You could cover this content in the following curriculum areas:

Online radicalisation

Children, young people and adult learners are at risk of accessing inappropriate and harmful extremist content online. This could include downloading or sharing terrorist material, which could be a criminal act.

The internet and social media make spreading divisive and hateful narratives easier. Extremist and terrorist groups and organisations use social media (for example, apps, forums, blogs, chat rooms) to identify and target vulnerable individuals.

Teaching could include:

All education settings have a responsibility under the Prevent duty. This includes building your students' resilience to extremism and ensuring staff are adequately trained to spot the signs of radicalisation.

Guidance, teaching resources and tools to help you teach young people about extremism, radicalisation and staying safe online are available on Educate Against Hate.

Challenges

Online challenges acquire mass followings and encourage others to take part in what they suggest.

Teaching could include:

You could cover this content in the following curriculum areas:

Content which incites

Knowing that violence can be incited online and escalate very quickly into offline violence.

Teaching could include:

You could cover this content in the following curriculum areas:

Fake profiles

Not everyone online is who they say they are.

Teaching could include:

explaining that in some cases profiles may be people posing as someone they are not (such as an adult posing as a child) or may be bots (which are automated software programs designed to create and control fake social media accounts)

how to look out for fake profiles, for example:

profile pictures that don't like right, for example, of a celebrity or object

accounts with no followers or thousands of followers

a public figure who doesn't have a verified account

You could cover this content in the following curriculum areas:

relationships education core content (all stages) - online relationships topic

computing (all key stages)

Grooming

Knowing about the different types of grooming and motivations for it, for example:

Teaching could include:

See the National Crime Agency's think u know website for further information on keeping children safe from sexual abuse and exploitation.

At all stages it will be important to balance teaching children about making sensible decisions to stay safe whilst being clear it is never the fault of a child who is abused and why victim blaming is always wrong.

You could cover this content in the following curriculum areas:

Live streaming

Live streaming (showing a video of yourself in real-time online either privately or to a public audience) can be popular with children but it carries risk when carrying it out and watching it.

Teaching could include:

You could cover this content in the following curriculum areas:

relationships education core content (all stages) - online relationships topic

health education core content (secondary) - internet safety and harms topic

Pornography

Knowing that sexually explicit material presents a distorted picture of sexual behaviours.

Teaching could include:

You could cover this content as part of the relationships and sex education core content (secondary), online and media topic.

Unsafe communication

Knowing different strategies for staying safe when communicating with others, especially people they do not know or have never met.

Teaching could include:

You could cover this content in the following curriculum areas:

Wellbeing

This section covers the elements of online activity that can adversely affect a pupil's wellbeing.

Age-specific advice on these potential harms and risks can be found in the following sections of the education for a connected world framework:

Impact on confidence (including body confidence)

Knowing about the impact of comparisons to 'unrealistic' online images.

Teaching could include:

You could cover this content as part of the health education core content (secondary), internet safety and harms topic.

Impact on quality of life, physical and mental health and relationships

Knowing how to identify when online behaviours stop being fun and begin to create anxiety, including that there needs to be a balance between time spent on and offline.

Teaching could include:

helping pupils to evaluate critically what they are doing online, why they are doing it, and for how long (screen time)

helping pupils to consider quality versus quantity of online activity

explaining that pupils need to consider if they are actually enjoying being online or just doing it out of habit, due to peer pressure or the fear of missing out

helping pupils to understand that time spent online gives users less time to do other activities - this can lead to some users becoming physically inactive

exploring the impact that excessive social media usage can have on levels of anxiety, depression and other mental health issues

explaining that isolation and loneliness can affect pupils and that it is very important for pupils to discuss their feeling with an adult and seek support

where to get help

You could cover this content as part of the health education core content (secondary), internet safety and harms topic.

Online versus offline behaviours

People can often behave differently online to how they would act face to face.

Teaching could include:

how and why people can often portray an exaggerated picture of their lives (especially online) and how that can lead to pressure

discussing how and why people are unkind or hurtful online, when they would not necessarily be unkind to someone face to face

You could cover this content as part of the relationships education core content (all stages), online relationships topic.

Reputational damage

What users post can affect future career opportunities and relationships - both positively and negatively.

Teaching could include:

looking at strategies for positive use

how to build a professional online profile

You could cover this content as part of the relationships and sex education core content (secondary), online and media topic.

Suicide, self-harm and eating disorders

Pupils may raise topics including eating disorders, self-harm and suicide. Teachers must be aware of the risks of encouraging or making these seem a more viable option for pupils and should take care to avoid giving instructions or methods and avoid using emotive language, videos or images.

Guidance on teaching about mental health and emotional wellbeing provides useful support for teachers in handling this material.

Vulnerable pupils

Any pupil can be vulnerable online, and their vulnerability can fluctuate depending on their age, developmental stage and personal circumstance.

However, there are some pupils, for example, looked after children and those with special educational needs, who may be more susceptible to online harm or have less support from family or friends in staying safe online. You should consider how you tailor your offer to make sure these pupils receive the information and support they need.

The following resources can help schools consider how best to support their most vulnerable pupils stay safe online:

Use of external resources

Schools are best placed to make their own decisions about which resources are educationally appropriate for their pupils. This includes reviewing resources, even when from a trusted source, as some will be more appropriate to their cohort of pupils than others.

Before using any resource, you should check:

Use of external visitors

Online safety can be a difficult and complex topic which changes very quickly. Therefore, schools may want to seek external support who have expertise, up to date knowledge and information.

The right external visitors can provide a useful and engaging approach to deliver online safety messages, but this should enhance a school's offer rather than be delivered in isolation.

Guidance for schools on using external visitors to support online safety education is available.

Safeguarding

As with any safeguarding lessons or activities, it is important that schools consider the topic they are covering and the potential that a child (or more than one child) in the class may be suffering from online abuse or harm in this way.

It is important to create a safe environment in which pupils feel comfortable to say what they feel. If a pupil thinks they will get into trouble or be judged for talking about something which happened to them online they may be put off reporting it and getting help.

Where schools are already aware of a child who is being abused or harmed online they should carefully plan any lesson to consider this, including not drawing attention to that child in a way that would highlight or publicise the abuse. It is good practice to include the designated safeguarding lead (or a deputy) when planning any safeguarding related lessons or activities (including online). They will be best placed to reflect and advise on any known safeguarding cases, and how to support any pupils who may be especially impacted by a lesson.

In some cases, a pupil will want to make a disclosure following a lesson or activity. The lesson may have provided the knowledge that enabled the pupils to realise they are being abused or harmed or give them the confidence to say something. This is why it is essential all pupils are clear what the school's reporting mechanisms are.

As per keeping children safe in education your reporting mechanisms should be child friendly and operate with the best interests of the pupil at their heart.

Whole school approach

Whole school approaches are likely to make teaching more effective than lessons alone. A whole school approach is one that goes beyond teaching to include all aspects of school life, including:

We recommend that schools embed teaching about online safety and harms within a whole school approach.

Incorporating the principles of online safety across all elements of school life

You should reflect the principles of online safety in the school's policies and practice where appropriate, and communicate this with staff, pupils and parents. This could include, for example:

having clear processes for reporting incidents or concerns in the child protection policy

reflecting online behaviours in the school's behaviour and bullying policies

Keeping children safe in education provides advice for schools on embedding online safety into their broader safeguarding and child protection approach.

Pupils should be just as clear about what is expected of them online as offline.

Engaging staff, pupils, parents and carers

Proactively engage staff, pupils, parents and carers in school activities that promote the agreed principles of online safety. This could include, for example:

co-designing programmes to reflect any emerging issues parents and pupils are hearing about or facing online

peer-to-peer support - consider implementing a scheme which supports pupils to help their peers stay safe online

Reviewing and maintaining the online safety principles

This includes making sure that school staff have access to up to date appropriate training and resources so that they are confident in covering the required content in a way that is relevant to their pupils' lives.

It could also include using information available to the school to review practices and ensure the issues facing their pupils are covered in a timely manner.

Embedding the online safety principles

Reinforce what is taught in lessons by taking appropriate and consistent action when a pupil:

makes a report of unacceptable online behaviours from another pupil, including cyberbullying

shares a concern about something they have seen online

Modelling the online safety principles consistently

This includes expecting the same standards of behaviour whenever a pupil is online at school - be it in class, logged on at the library or using their own device in the playground.

Schools should also ensure they extend support to parents, so they are able to incorporate the same principles of online safety at home.

Further sources of information

This list provides links to relevant government guidance and a range of national organisations who can offer support to schools.

Related guidance is available on:

Support and resources are also available from:

Schools can also get advice from national organisations such as:

You can refer parents to the following national organisations for support:

You can refer pupils to the following national organisations for support:

# data[].attributes.attachment_link.description
This non-statutory guidance outlines how schools can ensure their pupils understand how to stay safe and behave online as part of existing curriculum requirements. It complements existing subjects including: There are no additional teaching requirements. This guidance is for school leaders, school staff and governing bodies.

# data[].attributes.attachment_link.readable_text
The importance of meeting the standard

Schools and colleges should provide a safe environment to learn and work, including when online. Filtering and monitoring are both important parts of safeguarding pupils and staff from potentially harmful and inappropriate online material.

Clear roles, responsibilities and strategies are vital for delivering and maintaining effective filtering and monitoring systems. It's important that the right people are working together and using their professional expertise to make informed decisions.

How to meet the standard

Governing bodies and proprietors have overall strategic responsibility for filtering and monitoring and need assurance that the standards are being met.

To do this, they should identify and assign:

a member of the senior leadership team and a governor, to be responsible for ensuring these standards are met

the roles and responsibilities of staff and third parties, for example, external service providers

We are aware that there may not be full-time staff for each of these roles and responsibility may lie as part of a wider role within the school, college, or trust. However, it must be clear who is responsible and it must be possible to make prompt changes to your provision.

Technical requirements to meet the standard

The senior leadership team are responsible for:

procuring filtering and monitoring systems

documenting decisions on what is blocked or allowed and why

reviewing the effectiveness of your provision

overseeing reports

They are also responsible for making sure that all staff:

understand their role

are appropriately trained

follow policies, processes and procedures

act on reports and concerns

Senior leaders should work closely with governors or proprietors, the designated safeguarding lead ( DSL) and IT service providers in all aspects of filtering and monitoring. Your IT service provider may be a staff technician or an external service provider.

Day to day management of filtering and monitoring systems requires the specialist knowledge of both safeguarding and IT staff to be effective. The DSL should work closely together with IT service providers to meet the needs of your setting. You may need to ask filtering or monitoring providers for system specific training and support.

The DSL should take lead responsibility for safeguarding and online safety, which could include overseeing and acting on:

The IT service provider should have technical responsibility for:

The IT service provider should work with the senior leadership team and DSL to:

procure systems

identify risk

carry out reviews

carry out checks

When to meet the standard

You should already be meeting this standard.

# data[].attributes.attachment_link.title
Meeting digital and technology standards in schools and colleges

# data[].attributes.attachment_link.description
Find out what standards your school or college should meet on filtering and monitoring.

# data[].attributes.attachment_link.title
Search LGfL safeguarding and online safety resources | LGFL

# data[].attributes.attachment_link.description
Registered Address: ​9th Floor, 10 Exchange Square, Primrose Street, London, EC2A 2BR. London Grid for Learning Trust - a charity whose mission is the advancement of Education. A company limited by guarantee registered in England no 4205579 Reg charity no 1090412.

# data[].attributes.attachment_link.description
From KCSIE 2023, the DSL is asked to take lead responsibility for web filtering and consider the DfE standards. This page is to support your journey towards this - whether you are a beginner or have worked for years with your technical teams to better understand and effectively manage filtering - which is all about keeping children safe.

# data[].attributes.attachment_link.readable_text
Skip to main content

Cookies on GOV.UK

We use some essential cookies to make this website work.

We'd like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services.

We also use cookies set by other sites to help us deliver content from their services.

Accept additional cookies Reject additional cookies View cookies

Guidance on responding to incidents and safeguarding children and young people

Applies to England

Documents

Details

This non-statutory advice aims to support designated safeguarding leads (or equivalents) and senior leadership teams in education settings in England in responding effectively to incidents involving the sharing of nudes and semi-nudes.

It includes guidance on:

risk assessing incidents

safeguarding and supporting children and young people

handling devices and imagery

recording incidents, including the role of other agencies

providing education on the sharing of nudes and semi-nudes

This advice is non-statutory and should be read alongside the Department for Education's:

A one-page summary of how to respond to incidents is also available for all members of staff in education settings.

Thank you for your feedback

Report a problem with this page

# data[].attributes.attachment_link.title
Sharing nudes and semi-nudes: advice for education settings working with children and young people

# data[].attributes.attachment_link.description
Skip to main content We use some essential cookies to make this website work. We'd like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services. We also use cookies set by other sites to help us deliver content from their services.

# data[].attributes.attachment_link.readable_text
This document sets out the position of the Department for Education ( DfE) on the use of generative artificial intelligence ( AI), including large language models ( LLMs) like ChatGPT or Google Bard, in the education sector.

This statement:

Understanding generative AI

Generative AI refers to technology that can be used to create new content based on large volumes of data that models have been trained on from a variety of works and other sources. ChatGPT and Google Bard are generative artificial intelligence ( AI) tools built on large language models ( LLMs).

Tools such as ChatGPT and Google Bard can:

answer questions

complete written tasks

respond to prompts in a human-like way

Other forms of generative AI can produce:

AI technology is not new and we already use it in everyday life for:

email spam filtering

media recommendation systems

navigation apps

online chatbots

However, recent advances in technology mean that we can now use tools such as ChatGPT and Google Bard to produce AI-generated content. This creates opportunities and challenges for the education sector.

Opportunities for the education sector

Generative AI tools are good at quickly:

analysing, structuring, and writing text

turning prompts into audio, video and images

When used appropriately, generative AI has the potential to:

reduce workload across the education sector

free up teachers' time, allowing them to focus on delivering excellent teaching

However, the content produced by generative AI could be:

inaccurate

inappropriate

biased

taken out of context and without permission

out of date or unreliable

Using AI effectively

Teacher workload is an important issue and we are committed to helping teachers spend less time on non-pupil facing activities.

We are working with the education sector and with experts to identify opportunities to improve education and reduce workload using generative AI.

Having access to generative AI is not a substitute for having knowledge in our long-term memory. To make the most of generative AI, we need to have the knowledge to draw on.

We can only:

learn how to write good prompts if we can write clearly and understand the domain we are asking about

sense-check the results if we have a schema against which to compare them

Generative AI tools can make certain written tasks quicker and easier, but cannot replace the judgement and deep subject knowledge of a human expert. It is more important than ever that our education system ensures pupils acquire knowledge, expertise and intellectual capability.

The education sector should:

make the most of the opportunities that technology provides

use technology safely and effectively to deliver excellent education that prepares pupils to contribute to society and the future workplace

The limitations of generative AI tools

Generative AI tools can produce unreliable information, therefore any content produced requires professional judgement to check for appropriateness and accuracy.

Generative AI:

returns results based on the dataset it has been trained on - for example, a generative AI tool may not have been trained on the English curriculum

may not provide results that are comparable with a human-designed resource developed in the context of our curriculum

Whatever tools or resources are used to produce plans, policies or documents, the quality and content of the final document remains the professional responsibility of the person who produced it and the organisation they belong to.

Schools and colleges may wish to review homework policies and other types of unsupervised study to account for the availability of generative AI.

Higher education institutions may wish to review the intellectual asset management guide in regards to developing student policies on the IP they create, and how they interact and use IP of others in light of generative AI use.

Protecting data, pupils and staff

Generative AI:

stores and learns from the data it is given - any data entered should not be identifiable

can create believable content, including more credible scam emails requesting payment - people interact with generative AI differently and the content may seem more authoritative and believable

Schools and colleges should:

protect personal and special category data in accordance with data protection legislation

not allow or cause intellectual property, including pupils' work, to be used to train generative AI models, without appropriate consent or exemption to copyright

review and strengthen their cyber security by referring to the cyber standards - generative AI could increase the sophistication and credibility of attacks

ensure that children and young people are not accessing or creating harmful or inappropriate content online, including through generative AI - keeping children safe in education provides schools and colleges with information on:

what they need to do to protect pupils and students online

how they can limit children's exposure to risks from the school's or college's IT system

refer to the filtering and monitoring standard to make sure they have the appropriate systems in place

Find out more on:

Data privacy

It is important to be aware of the data privacy implications when using generative AI tools, as is the case with any new technology. Personal and special category data must be protected in accordance with data protection legislation.

If it is strictly necessary to use personal and special category data in generative AI tools within their setting, the education institution must ensure that the products and procedures comply with data protection legislation and their existing data privacy policies to protect the data.

Education institutions should also be open and transparent, ensuring the data subjects (pupils) understand their personal or special category data is being processed using AI tools.

Find out more about:

Intellectual property

Most generative tools will use the inputs submitted by users to further train and refine their models.

However, pupils own the intellectual property ( IP) rights to original content they create. Original content is likely to include anything that shows working out or is beyond multiple choice questions. Intellectual property can only be used to train AI if there is consent from the rights holder or an exemption to copyright applies.

Some tools allow users to opt out of inputs being used to train the models.

Education institutions must not allow or cause pupils' original work to be used to train generative AI models unless they have appropriate consent or exemption to copyright. Consent would need to be from the student if over 18, and from their parent or legal guardian if under 18.

Exemptions to copyright are limited, and education institutions may wish to take legal advice to ensure they are acting within the law.

Formal assessments

Schools, colleges, universities and awarding organisations need to continue to take reasonable steps where applicable to prevent malpractice involving the use of generative AI.

The Joint Council for Qualifications has published guidance on AI use in assessments to support teachers and exam centres in protecting the integrity of qualifications. This guidance includes information on:

what counts as AI misuse

the requirements for teachers and exam centres to help prevent and detect malpractice

Knowledge and skills for the future

To harness the potential of generative AI, students will benefit from a knowledge-rich curriculum which allows them to become well-informed users of technology and understand its impact on society. Strong foundational knowledge ensures students are developing the right skills to make best use of generative AI.

The education sector needs to:

prepare students for changing workplaces

teach students how to use emerging technologies, such as generative AI, safely and appropriately

At different stages of education, this teaching may include:

the limitations, reliability, and potential bias of generative AI

how information on the internet is organised and ranked

online safety to protect against harmful or misleading content

understanding and protecting IP rights

creating and using digital content safely and responsibly

the impact of technology, including disruptive and enabling technologies

foundational knowledge about how computers work, connect with each other, follow rules and process data

The Office for AI is currently conducting research into the skills that will be needed for future workforce training.

The education system should:

support students, particularly young pupils, to identify and use appropriate resources to support their ongoing education

encourage effective use of age-appropriate resources (which, in some instances, may include generative AI)

prevent over-reliance on a limited number of tools or resources

DfE will continue to work with experts to:

consider and respond to the implications of generative AI and other emerging technologies

support primary and secondary schools to teach a knowledge-rich computing curriculum to children up to the age of 16

# data[].attributes.attachment_link.title
Generative artificial intelligence (AI) in education

# data[].attributes.attachment_link.description
This document sets out the position of the Department for Education ( DfE) on the use of generative artificial intelligence ( AI), including large language models ( LLMs) like ChatGPT or Google Bard, in the education sector.

# data[].attributes.attachment_link.readable_text
Cookies on GOV.UK

We use some essential cookies to make this website work.

We'd like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services.

We also use cookies set by other sites to help us deliver content from their services.

You have accepted additional cookies. You can change your cookie settings at any time.

You have rejected additional cookies. You can change your cookie settings at any time.

Accept additional cookies Reject additional cookies View cookies

Skip to main content

How schools can prohibit the use of mobile phones throughout the school day.

Details

This guidance explains how to develop, implement and maintain a policy that prohibits the use of mobile phones in school. It should be read alongside the guidance on:

It is for:

multi-academy trusts

trust boards and proprietors

governing bodies

school leaders and staff

local authorities

It applies to all:

maintained schools

academies

free schools

non-maintained special schools

independent schools

# data[].attributes.attachment_link.description
How schools can prohibit the use of mobile phones throughout the school day.

# data[].attributes.attachment_link.authors[].name
Designed and Developed by Will Earp, South West Grid for Learning Trust Ltd

# data[].attributes.attachment_link.description
SWGfL is a charity dedicated to empowering the safe and secure use of technology globally. Find out more about online safety and security on our website

# data[].attributes.attachment_link.title
LGfL Safeguarding - Keeping Children Safe | LGFL

# data[].attributes.attachment_link.description
The SafeguardEd team within LGfL are here to help schools with all matters to do with safeguarding children, both online and offline. The SafeguardEd service is predominantly free to all schools, and offers a wide range of support including, extensive safeguarding training delivered by leading experts, policy guidance and templates and quality-assured resources for staff, parents and carers to help.

# data[].attributes.body
https://www.ncsc.gov.uk/pdfs/information/school-governor-questions.pdf

# data[].attributes.attachment_link.readable_text
The importance of meeting the standard

Properly configured firewalls prevent many attacks. They also make scanning for suitable hacking targets much harder.

How to meet the standard

Ask your IT service provider to set up your devices to meet the standards described in the technical requirements.

Agree with your IT service provider a system for monitoring logs and documenting decisions made on inbound traffic.

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

You are free to choose any suitable firewall.

Technical requirements to meet the standard

To meet this standard you must:

protect every device with a correctly configured boundary, or software firewall, or a device that performs the same function

change the default administrator password, or disable remote access on each firewall

protect access to the firewall's administrative interface with multi-factor authentication (MFA), or a small specified IP-allow list combined with a managed password, or prevent access from the internet entirely

keep firewall firmware up to date

check monitoring logs as they can be useful in detecting suspicious activity

block inbound unauthenticated connections by default

document reasons why particular inbound traffic has been permitted through the firewall

review reasons why particular inbound traffic has been permitted through the firewall often, change the rules when access is no longer needed

enable a software firewall for devices used on untrusted networks, like public wi-fi

Dependencies to the standard

See our broadband internet standards.

When to meet the standard

You should already be meeting this standard for the security of your networks. If you are not already meeting this standard you should make it a priority to review each device in your network.

The importance of meeting the standard

Security systems are sometimes disabled to make very marginal improvements to user experience. This is an unjustifiable risk calculation in most circumstances.

Attackers scan for and exploit devices where the security features are not enabled. Using the security features that devices already have is the most basic form of cyber security.

Attackers who gain physical access to a network device can exploit a system much more easily, so this should be prevented.

Recording network devices helps schools keep networks up-to-date and speeds up recovery.

How to meet the standard

Network devices include routers, switches, access points, servers and similar items.

Ask your IT service provider to record and set up your devices and boot up systems to meet the technical requirements.

Agree with your IT service provider a system for recording and reviewing decisions made about network security features.

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

The National Cyber Security Centre has published guidance on:

Technical requirements to meet the standard

To meet this standard you must:

keep a register, list, or diagram of all the network devices

avoid leaving network devices in unlocked or unattended locations

remove or disable unused user accounts, including guest and unused administrator accounts

change default device passwords

require authentication for users to access sensitive school data or network data

remove or disable all unnecessary software according to your organisational need

disable any auto-run features that allow file execution

set up filtering and monitoring services to work with the network's security features enabled

immediately change passwords which have been compromised or suspected of compromise

protect against a brute-force attack on all passwords by allowing no more than 10 guesses in 5 minutes, or locking devices after no more than 10 unsuccessful attempts

If network devices have conflicting security features, document the decisions you make on which security features have been enabled or disabled on your network. Review this document when you change these decisions.

To physically access switches and boot-up settings use a password or PIN of at least 6 characters. The password or PIN must only be used to access this device.

For all other devices, you must enforce password strength at the system level. If you use a deny list for automatic blocking of common passwords, use a password with at least 8 characters. If you do not use a deny list, use a password with at least 12 characters or a biometric test.

Password manager software is recommended.

The National Cyber Security Centre provides detailed guidance on:

Dependencies to the standard

See our standards on network switching.

When to meet the standard

You should already be meeting this standard.

The importance of meeting the standard

Successful cyber attacks target user accounts with the widest access and highest privileges on a network.

You must limit the numbers and access of network and global administrative accounts.

If you prevent and limit the compromise of these accounts you prevent and limit successful cyber attacks.

How to meet the standard

Ask your IT service provider or network manager to set up accounts to meet the technical requirements. If a single staff member controls account access, another senior school staff member or governor should approve that staff member's own account.

There must be a user account creation, approval and removal process. You should make this part of school joining and leaving protocols.

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

Technical requirements to meet the standard

You must control user accounts and access privileges. Including accounts used by third parties, for example, support services or device management.

Only authorised people can have an account which allows them to access, alter, disclose or delete the held personal data. The data owner or controller, or the data protection officer, must identify and authorise these tasks.

Users should have a separate account for routine business, including internet access, if their main account:

is an administrative account

enables the execution of software that makes significant system or security changes

can make changes to the operating system

can create new accounts

can change the privileges of existing accounts

Users must be authenticated with unique credentials before they access devices or services. This can include using passwords.

You must enforce password strength at the system level.

If you use a deny list for automatic blocking of common passwords, use a password with at least 8 characters. If you do not use a deny list, use a password with at least 12 characters or a biometric test. The National Cyber Security Centre recommends using passwords made up of 3 random words. Enforce account lockouts after a number of failed attempts and require service provider or network manager permission to unlock.

The National Cyber Security Centre provides guidance on password administration for system owners.

You must immediately change any password that has been compromised or suspected of compromise.

You must remove unused accounts. This may include the accounts of users who have left their employment, or accounts that have not been used for a prolonged period of time. This is particularly important for accounts with administrator privileges. You should review this termly.

Unused role privileges must be removed or disabled.

No user's account should have more access to devices than required to carry out their role.

Use different accounts with specific rights for different purposes or have IT service providers and administrators enable just-in-time access, giving individual users time-limited privileges as required. The National Cyber Security Centre provides detailed guidance on privileged access management.

For younger children or users with special educational needs:

consider using authentication methods other than passwords

consider using a separate account accessed by the teacher rather than the student

segment the network so such accounts cannot reach sensitive data

consider if the data or service being accessed requires authentication

The NCSC offers this guidance on alternatives to passwords.

You should not use global administrator accounts for routine business.

You should only use accounts requiring administrator privileges to complete the tasks that need it.

You should use service accounts for running system services and not user accounts.

When to meet the standard

You should implement this standard as soon as you can and with the introduction of each new account.

The importance of meeting the standard

Multi-factor authentication only allows access to a service when you present 2 or more different forms of authentication. It reduces the possibility of an attacker compromising an account. This is especially important if an account has access to sensitive or personal data.

In this context, sensitive or personal data is all data that if lost or compromised, would have a serious impact on the establishment, staff or students.

The Information Commissioner's Office explains what personal data is.

How to meet the standard

Ask your IT service provider to set up the applicable users with the multi-factor authentication methods which meet the technical requirements.

You should provide training to users unfamiliar with multi-factor authentication.

The National Cyber Security Centre provides detailed guidance on:

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

Technical requirements to meet the standard

Where practical, you must enable multi-factor authentication. This should always include cloud services for non-teaching staff. All staff are strongly encouraged to use multi-factor authentication.

Ask users for a second authentication factor when accessing sensitive data. For example, when moving from a lesson plan to financial or personal data.

Multi-factor authentication should include at least 2 of the following:

passwords constructed in the formats described earlier in standard 3

a managed device, that may belong to the organisation

an application on a trusted device

a device with a trusted network IP address, you should not use this in MFA for accounts with administrator rights or for accessing sensitive data

a physically separate token

a known/trusted account, where a second party authenticates another's credentials

a biometric test

When to meet the standard

You should implement this standard as soon as you can.

The importance of meeting the standard

Up-to-date anti-malware and anti-virus software reduces the risk from many forms of cyber attack.

Some applications protect against viruses and general malware, some against one only. You need to protect against both.

How to meet the standard

Ask your IT service provider to set up your devices to meet the technical requirements.

The National Cyber Security Centre publishes advice on antivirus and other security software.

Your IT service provider may be a staff technician or an external service provider.

Your school or college must organise the responsibilities and processes for risk-assessment, authorisation and documentation for any access to potentially malicious websites.

Remember that this standard may change over time with changing cyber threats.

Technical requirements to meet the standard

You must make sure anti-malware software and associated files and databases are kept up to date.

Make sure the anti-malware software:

is set up to scan files upon access, when downloaded, opened, or accessed from a network folder

scans web pages as they are accessed

prevents access to potentially malicious websites, unless risk-assessed, authorised and documented against a specific business requirement

Do not run applications or access data which has been identified as malware. Use the anti-malware software to eliminate the problem.

When to meet the standard

You should meet this standard as soon as you can.

The importance of meeting the standard

Applications can insert malware onto a network or have unintentional security weaknesses. This makes attacks easier to execute against a network.

Users should not download applications. The IT service provider should check them first.

How to meet the standard

Ask your IT service provider to set up your devices to meet the technical requirements. Agree how this will be done with your IT service provider and document how you have met the requirements.

The National Cyber Security Centre provides guidance on:

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

Technical requirements to meet the standard

The IT service provider should approve all code and applications that are deployed and make sure they do not pose a security risk. They should do this in the best way possible given available resources.

Best practice is to maintain a current list of approved applications. Applications with invalid or no digital signatures should not be installed or used.

You could search the internet to check the reputation of the application and the hosting site, or run unknown applications or code within a sandbox environment.

Make sure the network's anti-malware service is scanning all downloaded applications.

When to meet the standard

You should meet this standard as soon as possible.

The importance of meeting the standard

Hackers try to identify and exploit the vulnerability that each new security update addresses. They try to do this before users are able to update their systems. In the last year, several attacks on educational establishments have taken advantage of this.

Unsupported software does not receive security updates and over time it becomes:

more vulnerable as methods of exploitation are discovered

less compatible with the security measures integrated into the network operating system

You must not use unlicensed hardware or software.

Unlicensed software may not be a legitimate copy, or it may not be updatable to the latest secure standards.

You must avoid or replace unpatched or unsupported hardware or software, including operating systems. These devices are the most popular targets for successful cyber attacks. If this is not possible, then these devices and software must not be accessible from the internet - so that scanning tools cannot find weaknesses.

How to meet the standard

Ask your IT service provider to make sure all devices and software are licensed, supported and set up to meet the technical requirements.

Subscribing to services rather than buying items can be a way to help achieve this. This is known as Software as a Service ( SaaS).

So that appropriate risk assessment and mitigation can take place, your IT service provider should tell leadership and governors at the school or college and alter the network accordingly when devices or software:

have become unsupported

are about to become unsupported

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

The National Cyber Security Centre provides guidance on:

Technical requirements to meet the standard

All software must be currently licensed.

The licensing of most modern software can be checked through the software itself. Software which successfully updates can be presumed to be licensed. Older software may have to be researched.

You should remove unsupported software. If this is not possible then you must only use the software on parts of the network which prevent all traffic to and from the internet. Support does not have to come from the original manufacturer and can come from third parties as long as this does not invalidate a licence.

Unsupported devices must only access segmented areas of the network which do not grant access to sensitive data.

You must enable automatic updates.

You must complete manual updates to hardware or software, including configuration changes, within 14 days of the release of the patch where the vulnerability is:

described as high risk or worse

has a Common Vulnerability Scoring System (CVSSv3) score of 7 or above

The Common Vulnerability Scoring System is the security industry standard for measuring the danger of a vulnerability. The score is a number from 1 to 10 where 10 is the most dangerous. There is a more detailed explanation of CVSSv3 on the NVD website.

When notified by the Department for Education ( DfE), patches should be applied within 3 days of notification. This will only be done in instances of dangerous zero-day attacks where institutions are at immediate risk and there is a suitable patch available.

Dependencies to the standard

See our standards on network switching.

When to meet the standard

You should meet this standard as soon as possible.

The importance of meeting the standard

A backup is an additional copy of data, held in a different location, in case the original data is lost or damaged. If all copies were held in the same location, they would all be at risk from natural disasters and criminal damage.

Backups of important data are crucial for quick recovery in the event of disaster. The safest way to achieve this is to have a pattern of backing up on a rolling schedule. You should keep these backups off the network when not in use and check them regularly.

How to meet the standard

Ask your IT service provider to install and configure your devices to meet the standards described in the technical requirements. If your IT service provider is an external contractor, the scope of this should be included in your service agreement.

Be prepared to ask your service provider to explain what they are doing to help you achieve this standard. Including where the backups are located, how often they are done, how often they are checked and how long a restoration will take.

A school itself must determine which of its data is important to its operations but it is likely to include personal, financial, management and network data as a minimum.

The National Cyber Security Centre has published detailed guidance on:

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

Technical requirements to meet the standard

You should have at least 3 backup copies of important data, on at least 2 separate devices. At least 1 of these copies must be off-site (on large sites, these copies should be far enough away to avoid dangers from fire, flood, theft and similar risks).

Remember, you need 3 backup copies, you do not need 3 storage locations or 3 storage devices. For example, 2 backups taken at different times on the same device (as long as they do not overwrite each other) will count as 2 of the 3 backup copies.

You should schedule backups regularly. How often you need to create backups depends on:

how often the data changes

how difficult the information would be to replace if the backups failed

At least 1 of the backups must be offline at all times. An offline backup is sometimes known as a cold backup.

A cloud backup is an off-site backup. Cloud data held in separated cloud services are held in separate devices.

If the offline backup is in the cloud, access must be:

by a secure account identity

impossible from any device unless an authorised user has logged on in person

Remember, off-site means in an alternative physical or digital location, offline means that is not connected to the network

The number of devices with these access permissions must be kept to an absolute minimum.

A secure account identity is defined as a specified account secured with a username and multi-factor authentication.

A device which cannot access the backup is defined as a device that has no valid credentials.

Where the cloud services allow it, set up the controls to:

only allow authorised devices to create new or appended backups

deny connection requests when backup is not in use

Regularly check that the backups work.

When to meet the standard

You should implement this standard as soon as you can.

The importance of meeting the standard

Being unprepared for a cyber attack can lead to poor decisions, slow recovery and expensive mistakes.

A good response plan made ahead of time will speed up your response, reduce stress levels and confusion.

Effective response will reduce the material, reputational and safeguarding damage from ransomware attacks.

How to meet the standard

Talk to your IT service provider and make sure you have a cyber attack contingency plan. The plan must be part of your business continuity and disaster recovery plan.

The school's governors should ensure the creation and testing of these plans. In multi-academy trusts, oversight might happen at trust level.

The National Cyber Security Centre provides advice on contingency planning:

To help with testing, they also provide an exercise kit.

As part of the Risk Protection Arrangement there is a template cyber response plan.

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

Technical requirements to meet the standard

All schools and colleges must include a contingency plan for loss of some or all IT systems in their business continuity and disaster recovery plan. This is required by the schools financial value standard.

This plan must include:

staff responsibilities

out of hours contacts and procedures

internal and external reporting and communications plans

priorities for service restoration

the minimum operational IT requirements

where you can find additional help and resources

Keep hard copies of key information in case of total system failure.

Test and review these plans regularly.

When to meet the standard

You should meet this standard as soon as possible.

The importance of meeting the standard

Cyber attacks are crimes against a school that need to be investigated so perpetrators can be found and counter-measures identified.

A cyber attack is defined as an intentional and unauthorised attempt to access or compromise the data, hardware or software on a computer network or system. An attack could be made by a person outside or inside the school.

The National Cyber Security Centre define what a cyber incident is.

This compromise of data might include:

stealing the data

copying the data

tampering with the data

damaging or disrupting the data, or similar

unauthorised access

You should report any suspicious cyber incident to Action Fraud on 0300 123 2040 or on the Action Fraud website.

Police investigations may find out if any compromised data has been published or sold and identify the perpetrator.

How to meet the standard

Ask your IT service provider to notify the school leadership team of all cyber attacks. Appropriate action and information-sharing must be carried out in accordance with the General Data Protection Regulation (GDPR).

Where a data breach has or may have occurred, report to the Information Commissioner's Office ( ICO).

These incidents should also be reported to the DfE sector cyber team at Sector.Incidentreporting@education.gov.uk.

Academy trusts have to report these attacks to ESFA.

Exercise judgement in reporting. Incidents where any compromise may have taken place or other damage was caused should be reported. But receipt of a phishing email alone, for example, does not require reporting to DfE but can be reported to Action Fraud at report@phishing.gov.uk.

Where the incident causes long term school closure, the closure of more than 1 school or serious financial damage, you should also inform the National Cyber Security Centre.

Technical requirements to meet the standard

Schools and colleges must report cyber attacks to:

Where applicable schools and colleges must report cyber attacks to ICO.

You must act in accordance with:

When to meet the standard

You should implement this standard as soon as you can.

The importance of meeting the standard

The protection of sensitive and personal data is vital to:

the safety of staff and students

the reputation of schools and colleges

the confidence placed in schools and colleges

avoid the legal liabilities which security breaches expose schools and colleges to

How to meet the standard

You should control access to data in consultation with your IT service provider and the Data Protection Officer. This is to safeguard staff and students as required by the General Data Protection Regulation (GDPR).

To meet the standard, you must:

understand the definition of personal data

assess the risk of compromise, and the degree of damage caused by a security compromise, to work out the resources required to protect the data

pseudonymise or encrypt any personal data while stored and in transit to a third party

ensure the confidentiality, integrity and availability of the data and systems processing them

restore complete and accurate data after an incident in a timely fashion

design and apply processes for testing and assessing the effectiveness of all measures used to safeguard data and its use

There is DfE guidance on:

Technical requirements to meet the standard

Academy trusts should incorporate the risk assessment into the risk register.

If you rely upon encryption to protect data, this should be:

strong encryption

using encryption systems that are still supported

with a life appropriate to the sensitivity of the data being stored

The ICO provides advice on how data encryption should be used.

The ICO also provides a template for DPIA.

Additional protection or password protection should meet the technical requirements in the account access standard.

You should limit access to those staff with a specific need. Do this by specific content area, and not blanket permissions.

By achieving all the cyber standards you can meet the additional requirements for:

When to meet the standard

You should already be meeting this standard in accordance with GDPR.

The importance of meeting the standard

The most common forms of cyber attack rely on mistakes by staff members to be successful. Avoiding these mistakes prevents the attacks.

Basic cyber security knowledge amongst staff and governors is vital in promoting a more risk aware school culture.

How to meet the standard

Staff with access to your IT network must take basic cyber security training every year.

At least one member of the governing body should complete the training.

Remember that the training may change over time with changing cyber threats.

Technical requirements to meet the standard

Staff who require access to your IT network must take basic cyber security training every year. The training should be part of the induction training for new staff

This training should focus on:

phishing

password security

social engineering

the dangers of removable storage media

The National Cyber Security Centre has published suitable training materials:

At least one current governor must complete the same basic cyber security training. These governors should read the NCSC publication school cyber security questions for governors.

When to meet the standard

You should be looking to implement this standard as soon as you can but within 12 months as a minimum.

# data[].attributes.attachment_link.title
Meeting digital and technology standards in schools and colleges

# data[].attributes.attachment_link.description
Find out what standards your school or college should meet on cyber security, user accounts and data protection.

# data[].attributes.attachment_link.readable_text
The Prevent duty requires all education providers 'to help prevent the risk of people becoming terrorists or supporting terrorism'. This includes safeguarding learners from extremist ideologies and radicalisation.

Most importantly, providers should consider the needs of children, young people and adult learners at each stage of the safeguarding process. Providers should consider radicalisation concerns in line with their existing safeguarding processes, skills and experience.

Managing radicalisation and extremism safeguarding concerns

Safeguarding learners who are susceptible to radicalisation into terrorism depends on effective partnership.

To comply with the Prevent duty, schools, colleges and further education independent training providers must show evidence of:

productive co-operation, in particular with local Prevent staff, the police and local authorities

co-ordination through existing multi-agency forums

Each local authority has its own referral routes for safeguarding learners from radicalisation and extremism. Effective partnerships will ensure that you understand these processes.

Find out your Prevent referral process in your local authority.

Contact and build partnerships with your:

local authority Prevent lead

local authority Prevent education officer (if you have one)

DfE regional Prevent coordinator

local authority children or adult services

safeguarding children partnership

local policing team (search on your local police website)

Contact partners to understand the local risk and threats in your area.

Make sure you understand what radicalisation means and why learners may be susceptible to being drawn into terrorism. For more information, read 'how children, young people and adult learners become susceptible to radicalisation' in understanding and identifying radicalisation in your educational setting.

Make sure you know how to get advice from a wide range of professionals in children's social care. Find out how to ask for support from your local Prevent teams or the police when you need it.

Make sure you're familiar with the support available for someone at risk of radicalisation. For more information, read managing the risk of radicalisation in your educational setting.

Think about what support your setting can give to a learner who is susceptible to radicalisation into terrorism.

Think about how your curriculum can build resilience to radicalisation for all learners.

Staff responsibilities in relation to the Prevent duty

All staff should look out for concerning changes in behaviour and report them to the designated safeguarding lead ( DSL).

Behaviours that might cause concern

Any concerning changes in behaviour may indicate a safeguarding concern. These changes can be emotional, verbal or physical.

A learner may be vulnerable in certain ways that could make them more susceptible to a range of harms. These could include sexual exploitation, extremism and radicalisation, or serious violence.

For more information, read understanding and identifying radicalisation risk in your educational setting.

How to raise concerns

If staff have any concerns about a learner's welfare, they should speak to the DSL immediately. All staff should refer to their setting's safeguarding procedures.

Staff should know about:

Staff in further education (FE) should know about the Prevent for further education and training:

For more information, staff should speak to the DSL.

How to report extremism

If you need to report extremism concerns about an adult working in a school, college or organisation that works with children, young people or adult learners, you should:

contact your local authority designated officer (LADO) through your local safeguarding partnership or local authority

submit the details at report extremism in education

Online training for Prevent awareness

Online courses on Prevent awareness include:

For more information about available training, contact your local authority.

Resources for teachers and school leaders

You can get more guidance, resources and practical advice from:

# data[].attributes.attachment_link.title
The Prevent duty: an introduction for those with safeguarding responsibilities

# data[].attributes.attachment_link.description
The Prevent duty requires all education providers 'to help prevent the risk of people becoming terrorists or supporting terrorism'. This includes safeguarding learners from extremist ideologies and radicalisation. Most importantly, providers should consider the needs of children, young people and adult learners at each stage of the safeguarding process.