DfE Digital and Technology Standards for Schools and Colleges: A Checklist for Every Standard
The Department for Education's digital and technology standards describe what good school technology looks like, from the broadband line to the people who support it. This guide lists all twelve areas, shows which are core standards for 2030, and gives a short checklist for each one.
All twelve DfE digital and technology standards at a glance
The DfE first published standards in March 2022 and has added areas since. Six are labelled core. Select any tile to jump to its checklist.
The DfE links the 2030 target for core standards to its work on narrowing the digital divide. It also asks schools to keep referring to all the standards, not only the core six. Details change, so check the current guidance before you sign a contract.
Tick the filtering box with a service that needs no hardware
Of the twelve standards, filtering and monitoring is the one our hosted CIPA filter speaks to, and only the filtering half of it. We run the DNS filter for you, so your broadband and network work stays separate from it.
- Adult and VPN/Proxy/Anonymizers are on from the start
- Each school in a trust has its own settings in one console
- Reports and a policy record can sit in your evidence folder
The six core standards, with checklists
Each card summarises what the standard asks, in our own words, and gives a checklist you can use in a meeting with your IT support or provider.
Broadband internet
Fast, resilient internet with security and safeguarding in place.
What it asks
- A full fibre connection: at least 100Mbps download and 30Mbps upload for primary schools, and capacity for 1Gbps both ways for secondary schools and colleges.
- A backup connection of a different type, with automatic failover.
- Appropriate IT security and safeguarding, including a firewall and content filtering that meets KCSIE.
Checklist
- Is our connection full fibre, not copper?
- Do measured speeds meet the figure for our phase?
- When does the current contract end, and does it allow a move to fibre?
- Do we have a second connection of a different type?
- Does failover switch over automatically? Have we tested it?
- Is the firewall in place and who manages it?
- Does content filtering apply to all traffic on the line?
Wireless network
Reliable Wi-Fi across the site, centrally managed and secure.
What it asks
- Use current wireless standards when upgrading: since April 2026 the DfE cites Wi-Fi 7 for upgrades, and only when the network no longer meets needs.
- A fully functional signal throughout buildings and outside where needed.
- Central management with alerts and automatic security updates.
- Security features such as individual authentication, current encryption and separate guest access.
Checklist
- Is there a heat map showing coverage in every teaching space?
- Can the network handle every device logging on at once?
- Is guest access separated from pupil and staff networks?
- Do guest and personal devices still pass through filtering?
- Are admin accounts documented and protected?
- Do access points receive security updates automatically?
Network switching
Fast, managed and secure switches with protected power.
What it asks
- Fast, reliable connections for wired and wireless users, with at least 1Gbps to desktops.
- A platform to manage switches centrally, with alerts and long manufacturer support.
- Security features: segregation, documented admin accounts, automatic updates, access control for guest devices.
- Core switches connected to at least one uninterruptible power supply.
Checklist
- Are any switches past the point of receiving security updates?
- Is there a central view of switch health and failures?
- Are pupil, staff, guest and building systems on separate networks?
- Are core switches protected by a UPS?
- Who holds the admin passwords, and are they recorded securely?
Digital leadership and governance
A senior owner, up-to-date registers, resilience plans and a strategy.
What it asks
- A senior leadership team member responsible for digital technology, who need not be a technical expert.
- Up-to-date contracts, asset and information asset registers.
- Digital technology included in disaster recovery and business continuity plans, tested at least yearly.
- A digital technology strategy covering at least two years, reviewed every year.
Checklist
- Who is our senior digital lead, and does the governing body know?
- Is the filtering and monitoring contract in the contracts register?
- Does the asset register list every device with its review and disposal dates?
- When did we last test the disaster recovery plan?
- Do staff know who to contact if systems go down?
- Is the strategy linked to the school development plan and budget?
Filtering and monitoring
The safeguarding standard: roles, review, filtering and monitoring.
What it asks
- Assign roles: a senior leader and a governor make sure the standards are met; the DSL and IT support work together.
- Review provision at least once every academic year and after significant changes.
- Block harmful and inappropriate content without unreasonably affecting teaching, using lists users cannot switch off.
- Have monitoring strategies that meet the school's safeguarding needs.
- Consider generative AI when scoping and reviewing provision.
Checklist
- Are the senior leader and governor named in minutes?
- Is the annual review booked and recorded?
- Has the provider confirmed IWF membership and the police-assessed terrorism list?
- Are there separate profiles for pupils by age and for staff?
- Does filtering cover school devices, personal devices and guests?
- Do monitoring reports and urgent alerts reach the DSL?
- Have we decided which AI tools are allowed for whom?
Filtering and monitoring is the one core standard schools should already meet. Read the detail in our DfE filtering and monitoring standards guide and the statutory side in KCSIE filtering and monitoring.
Cyber security
Seven standards for leaders and IT support, rebuilt in May 2024.
What it asks
- A cyber risk assessment every year, reviewed each term.
- A cyber awareness plan with an acceptable use policy and yearly training.
- A properly configured boundary firewall and centrally managed anti-malware.
- Controlled accounts, with multi-factor authentication for staff with cloud or remote access and all IT admin accounts.
- Licensed, supported software, with critical or high-risk fixes applied within 14 days.
- A backup plan: at least three copies, on two devices, one off site, with immutable backups.
- A clear process for reporting cyber attacks, internally and externally.
Checklist
- Is cyber risk on the school risk register?
- Have all staff and at least one governor had cyber training this year?
- Is MFA switched on for every admin and remote access account?
- Are leavers' accounts disabled promptly?
- Are backups tested and logged each term?
- Do staff know how to report a suspected attack?
- Are web filtering and the firewall reviewed together?
The six other standards, with checklists
These are not labelled core and have no 2030 target, but the DfE still expects schools to refer to them, usually when replacing equipment or reviewing support.
IT support
Added November 2025: support that helps you meet every other standard.
What it asks
- IT support that helps the school meet the digital and technology standards.
- Active maintenance and improvement in line with the digital strategy, including working with the DSL on filtering and monitoring.
- Responsive support with agreed priorities, channels and records of every request.
- A formal review of IT support at least once a year, led by the senior digital lead.
- Clear guidance and training for staff, updated when new technology such as generative AI tools arrives.
Checklist
- Do we have written response and resolution targets?
- Is every support request logged until it is resolved?
- Does IT support know how to pass safeguarding concerns to the DSL?
- Has the senior digital lead reviewed support this year and reported to governors?
- Is there plain-English guidance for common tasks?
- Does induction cover key systems and cyber awareness?
Cloud solutions
Using cloud services safely in place of local systems.
What it asks
- Use cloud solutions as an alternative to locally hosted systems where sensible.
- Cloud services must follow data protection law, with DPIAs for personal data.
- Single sign-on style identity and access management for all users.
- Services that work on a range of devices and are available when needed.
- Backups checked, since providers may keep deleted data only for a short time.
Checklist
- Do we know where each cloud service stores our data?
- Is there a DPIA for each service holding personal data?
- Does each user have one login managed centrally?
- Do we back up critical cloud data ourselves?
- Are cloud apps covered by filtering on school devices off site?
Laptops, desktops and tablets
Devices that meet learning needs and are safe, secure and sustainable.
What it asks
- Devices that meet educational needs and support the digital strategy.
- Safe and secure devices, centrally managed, with filtering and monitoring checked against KCSIE.
- Minimum requirements such as education or enterprise operating systems and set support periods.
- Energy-efficient use, sustainable buying and secure, legal disposal.
Checklist
- Is every device enrolled in central management?
- Does filtering follow take-home devices off site?
- Will each model receive security updates for its expected life?
- Is there a DPIA for pupil devices?
- Are old devices wiped and disposed of with certificates?
Servers and storage
Resilient, secure, efficient local systems in a proper room.
What it asks
- Systems that keep running if a single component fails.
- Security and data protection by design, reviewed at least termly.
- Energy efficiency as a stated buying requirement.
- A dedicated, secure, locked space with suitable power and cooling.
Checklist
- Do critical servers have a UPS and redundant power?
- Is the server room locked and used for nothing else?
- Could any local server move to a cloud service?
- Are servers on the asset register with support end dates?
Network cabling
Cabling that will last, installed and tested properly.
What it asks
- Copper cabling to Category 6A, with permanent links no longer than 90 metres.
- Optical fibre of at least 16 core multi-mode OM4 between buildings and hub rooms.
- Installation and testing by approved installers, with a long manufacturer warranty on the whole system.
Checklist
- Is new cabling specified to Category 6A?
- Did the installer provide a full test report?
- Is there a manufacturer warranty covering the complete system?
- Are cable routes and patch panels documented?
Digital accessibility
Technology and communications that everyone can use.
What it asks
- Include digital accessibility in relevant strategies and policies, including SEND.
- Hardware and software that support accessibility features and assistive technology.
- Accessible communications for pupils, staff, parents and carers.
Checklist
- Does the digital strategy mention accessibility?
- Do security or filtering settings block any accessibility tools pupils need?
- Do suppliers provide accessibility statements?
- Is the school website accessible?
- Do staff know how to create accessible documents?
Official and reference sites that should never be caught by a block
A filter that tightens up must not shut out the guidance schools rely on. These are the labels our database gives to some of those sites.
| Domain | Categories in our data |
|---|---|
| gov.uk | Government & Legal |
| education.gov.uk | Education/Reference, Government & Legal |
| ofsted.gov.uk | Government & Legal |
| swgfl.org.uk | Education/Reference, Community Sites |
| internetmatters.org | Education/Reference, Community Sites |
Key dates in the digital and technology standards
The standards are updated regularly. These dates come from the DfE's update history and explain why an older checklist may be out of date.
| Date | What changed | Why it matters for filtering |
|---|---|---|
| 23 Mar 2022 | First standards published: broadband, switching, cabling and wireless. | The network that the filter sits on. |
| 10 Oct 2022 | Cyber security standards added. | Firewalls and filtering work together. |
| 29 Mar 2023 | Filtering and monitoring, cloud, and servers and storage standards added. | The safeguarding standard arrives, later referenced in KCSIE 2023. |
| Jan 2024 | Digital leadership and governance, devices, and digital accessibility added. | A senior digital lead and device management. |
| 20 May 2024 | Cyber security restructured into seven standards. | Clearer split between leaders and IT support. |
| 22 Oct 2024 | Filtering and monitoring substantially revised. | Generative AI, safe search, BYOD and bypass technologies covered. |
| 17 Nov 2025 | IT support standards added. | IT support works with the DSL on filtering and monitoring. |
| 2026 | Several updates, including Wi-Fi 7 for upgrades, Cyber Essentials changes, and filtering and monitoring updates on AI and timing. | Check the current text before each annual review. |
See how this lines up with the statutory guidance in KCSIE 2024 changes and KCSIE 2026 changes.
What the filtering owner can hand over at review time
The hosted filter produces activity reports and a policy record, and its log can be exported for a file. That gives the senior digital lead something to show governors without gathering screenshots.
Roles across the digital and technology standards
The standards share work between a few people. Agreeing this early stops tasks falling between safeguarding, IT and the business office.
Senior digital lead
Owns the strategy, registers and the yearly review of IT support. Links technical staff with the DSL, the DPO and finance.
DSL
Leads on the safeguarding side of filtering and monitoring and works with IT support on reports and changes.
IT support
Maintains, patches and monitors systems, runs backups and makes agreed changes, in-house or through a provider.
Governors
Approve key policies, name a governor for filtering and monitoring, and may appoint a digital link governor.
The DfE's free "Plan technology for your school" service helps schools self-assess against the standards and get recommendations. Use it alongside these checklists and keep the results with your review records.
How category data supports the filtering and monitoring standard
Of the twelve areas, our work sits inside one: the filtering part of the filtering and monitoring standard. Clear categories help you block harm without blocking learning.
| Standard need | How category data helps |
|---|---|
| Different profiles for different users | 58 web filtering categories make separate pupil age groups and staff rules simple to build. |
| Blocking without over-blocking | A site can carry several ranked categories, so a useful site is not blocked for one minor section. |
| Coverage of new sites | About 300,000 newly registered domains categorised daily and rechecked after a week and a month. |
| Generative AI scope | 11,800+ AI-tool domains in 18 categories, updated daily, for your AI decisions. |
| Readable reports | Reports grouped by category help the DSL spot trends without reading raw addresses. |
Category filtering is one layer. It does not monitor messages or behaviour and does not replace the IWF and police-assessed terrorism lists from accredited providers. Concerns go to the DSL through your safeguarding process. See the category database, our hosted DNS filter or the domain checker.
The filtering standard handled in-house or by a hosted service
Each row is a task the filtering lead has to cover for the school or trust.
| Task | Run it yourself | Hosted CIPA filter |
|---|---|---|
| Getting the filter on the network | Appliance, licences and setup time | One DNS setting on the router or firewall |
| Different rules for primary and secondary | Separate policies you maintain | One console, separate settings per school or branch |
| Staff who need blocked material | A rule change someone must reverse | PIN bypass for 15, 30 or 60 minutes, logged, then it switches back |
| Bypass attempts | A list of proxies that ages quickly | VPN/Proxy/Anonymizers blocked as a category |
| Laptops used away from school | An agent to install and update | A private encrypted link keeps the same rules |
| Evidence of the annual review | Notes in a shared folder | Activity reports, a policy record and a log export |
DfE digital and technology standards: frequently asked questions
What are the DfE digital and technology standards?
They are Department for Education standards that describe what good digital technology looks like in schools and colleges in England. There are 12 areas, from broadband and wireless to cyber security, filtering and monitoring and IT support. Six are core standards that schools and colleges should work towards meeting by 2030.
Which are the six core standards?
Broadband internet, wireless network, network switching, digital leadership and governance, filtering and monitoring, and cyber security.
Are the digital and technology standards mandatory?
The standards themselves are departmental guidance. However, the filtering and monitoring standard is linked to statutory safeguarding guidance in KCSIE and should already be met, and the cyber security standards are referenced in KCSIE. For the other core standards the DfE asks schools to work towards them by 2030.
When was the IT support standard added?
The IT support standards for schools and colleges were added on 17 November 2025. They cover making sure IT support helps meet the standards, maintenance, responsiveness, an annual review of IT support and staff training.
How can a school check itself against the standards?
The DfE runs a free service called Plan technology for your school, which helps schools self-assess against the standards and get recommendations. Many schools also keep their own checklist and review it alongside their digital strategy each year.
Related guides
- Filtering and Monitoring Standards for Schools: DfE Guide
- Filtering and Monitoring Annual Review Checklist for Schools
- Filtering for Multi-Academy Trusts: Central Policy, Local Checks
- DfE Generative AI Guidance for Schools: What It Means for Filtering
- Appropriate Filtering Provider Checklist: Reading UKSIC Responses
We quote from the number of schools and devices, and the quote arrives within one business day. If you want to see the filtering standard in practice first, a pilot on one site shows the blocks and the reports before the rest of the trust is involved.
Talk to us about your school or trust
Working through the standards for one school or a whole trust? We can show where category data fits in the filtering and monitoring standard, and how it keeps your rules current.