What the DfE cyber security standards for schools and colleges require, and how penetration testing helps you meet and evidence them.
What are the DfE cyber security standards?
The DfE cyber security standards for schools and colleges, published in 2022 and updated in 2024, set out what education organisations should do to be cyber resilient: an annual cyber risk assessment reviewed each term, secured systems and user accounts, anti-malware and firewalls, backups, and a cyber response plan.
Why it matters
Meeting them matters for ESFA and DfE grant conditions, for RPA cover, and above all for protecting pupil and staff data. But a checklist completed on paper is not the same as controls that actually work.
How Solusec tests it
Penetration testing validates that your DfE-standard controls hold up in practice, informs your annual cyber risk assessment with real evidence, and shows leadership and governors exactly where to act.
Education testing, done right
Solusec is a CREST-accredited penetration testing provider and a member of the BESA LaunchPad programme for education suppliers. We test in line with the DfE cyber security standards, understand KCSIE filtering and monitoring duties, MIS platforms and safeguarding systems, and keep pupil and staff data safe throughout. You deal directly with the tester, not a call centre.
What you get
You get a clear, prioritised report mapped to risk and to the DfE cyber security standards, a plain-English summary for leadership and governors, practical fixes for your IT team or MSP, and a free retest once you have remediated.
Common questions
Do the DfE standards require penetration testing?
They require an annual cyber risk assessment and secured systems rather than a specific test, but testing is the most reliable way to evidence that your controls work and to inform that assessment.
When were the standards last updated?
They were published in 2022 and updated in 2024, and sit within the DfE's wider digital and technology standards for schools and colleges.
How quickly can testing start?
After a short, free scoping call we give a fixed price and a start date, often within days.
Do you keep our data safe during testing?
Yes. Testing is scoped and conducted to protect pupil, student and staff data throughout, and we are CREST-accredited.
Related education testing
Solusec
Typically replies within one business day
Had an incident, or need a penetration test or Cyber Essentials at short notice?
Tell us what you're dealing with and we'll come back to you.
+44 (0)1902 288763 ✉️ Email us
info@solusec.co.uk 📝 Leave a message
We'll reply within one business day