DfE digital standards
Benchmark broadband, wireless, switching, digital leadership, filtering and monitoring, and cyber security.
EDUCATION CONSULTANCY / IT
Review IT standards, cyber resilience, contracts and the future digital roadmap.
Book a MAT discovery call →Explore all MAT servicesWho we support
CIOs, IT directors, CFOs and trust leaders. We focus on practical advice, clear accountability and proportionate assurance.
Benchmark broadband, wireless, switching, digital leadership, filtering and monitoring, and cyber security.
Review MIS, cloud services, licences, supplier resilience, data processing and total cost of ownership.
Prioritise infrastructure, security, accessibility, training and sustainable investment.
DfE standards & assurance
A required statutory audit or inspection is different from a recommended management review. Applicability depends on the trust, buildings, systems and activity. The 2026 Academy Trust Handbook is effective from 1 October 2026.
Regular filtering and monitoring effectiveness reviews, cyber risk assessment, access and backup recovery testing as appropriate.
Check procurement decisions and approvals against trust obligations, including applicable MIS procurement requirements.
DfE digital standards gap assessment, supplier and licensing audit, security and data protection review.
Understand the trust structure, objectives, current assurance and key constraints.
Examine documents, interviews, data and evidence against the agreed scope.
Present a prioritised action plan, ownership, timescales and optional implementation support.
Practical answers for academy trust leaders. Check current DfE guidance and obtain professional advice for trust-specific decisions.
They set out recommended expectations for school technology, including infrastructure, leadership, filtering and monitoring, and cyber security. Review the current standards individually on GOV.UK.
Not all DfE digital standards are statutory duties. They should be distinguished from legal safeguarding, data protection and other obligations.
Review appropriateness and effectiveness regularly, including leadership ownership, user groups, alerts, escalation, safeguarding oversight and the impact on access to learning.
Identity and access, MFA, device security, backups, recovery testing, patching, incident response, supplier access, training and governance.
Testing should follow a risk-based schedule and confirm that critical systems and data can be restored within agreed recovery objectives.
Assess functionality, data migration, security, interoperability, implementation capacity, contract terms and whole-life cost.
Device or service owner, location, lifecycle, support status, licence, security controls and replacement planning.
Potential risks include duplicated spend, unclear accountability, inconsistent security, difficult support escalation and limited visibility of contractual commitments.
A DPIA is required where processing is likely to result in high risk to individuals. The trust should assess proposed systems and consult its data protection lead.
No. A strategic review identifies governance and control gaps; specialist security testing should be commissioned separately where appropriate.
Review licences, device lifecycle, procurement frameworks and duplicated services without weakening security, accessibility or teaching continuity.
A documented baseline, evidence gaps, prioritised actions and an achievable investment and governance roadmap.