Digital Resilience Baseline Schools & Trusts

A role description, responsibility framework or governance record identifies the senior lead and their responsibilities.

Responsibilities appear in governance documents, policies, role descriptions or equivalent records and are communicated to relevant staff.

Board or committee reports, risk-register discussions, minutes, dashboards or recorded escalation of significant issues.

Responsibilities are documented rather than assumed, including where services are shared, outsourced or provided by an LA or other organisation.

Contracts, SLAs, service descriptions or other records define what support is provided and how significant problems are escalated.

Service reports, review meetings, assurance reports, control evidence or other information beyond simply being told that “IT handles it.”

Current asset, system, information-asset or service records identify important technology and information dependencies.

Critical systems and services are explicitly identified through business-continuity, risk, asset-management or similar work.

A current risk register or equivalent records significant cyber risks, ownership, controls and required actions.

Appropriate reporting or assurance covering areas such as patching, firewalls, endpoint protection, secure configuration and vulnerability management.

Unsupported systems, overdue critical updates, known vulnerabilities or significant control gaps are reported and escalated rather than remaining solely within IT.

Improvement plans identify actions, owners and target dates, with progress followed through.

An account-management process covers creation, changes to permissions and periodic review where appropriate.

Privileged accounts can be identified, their purpose is understood and elevated access is limited to those who need it.

The school or trust can evidence appropriate MFA coverage and a reliable joiner/mover/leaver process, including prompt removal of access when someone leaves.

Recovery priorities identify what must be restored first following serious disruption.

A current backup plan or provider evidence shows what is backed up, how it is protected and how recovery would work.

There is evidence of successful restoration testing—not simply evidence that scheduled backup jobs have run.

Training or awareness activity is provided regularly, with additional support where particular roles or risks require it.

Reporting routes are clearly communicated and staff know what to do if they click something suspicious, disclose information accidentally or notice unusual activity.

Communications, training and leadership practice encourage people to raise concerns promptly so that problems can be investigated and contained.

A documented plan addresses significant disruption to systems, services or data and connects with wider continuity arrangements.

People know who coordinates the response, who can make important decisions and which internal and external parties may need to be contacted.

A tabletop exercise, scenario discussion, technical test or other activity demonstrates that the plan has been used rather than existing only on paper.

There is a defined review cycle plus additional review following significant incidents, technology changes or changes in risk.

Lessons are recorded and translated into changes to controls, processes, plans, training or other arrangements.

Actions have owners and target dates and remain visible until completed or formally accepted.