Ofsted Inspections - What IT resources are required?

[enbiggen]

Hi Everyone,

 

We're moving into our Ofsted window and I'm wondering what IT requirements might be required?

 

Do we have to provide Wi-Fi access (our policy doesn't allow non-school devices on our Wi-Fi network), or can we provide a wired connection? We'd probably patch in our direct to ADSL backup connection (informing them that this is a non-filtered service, and is limited to that room for the duration of their stay).

 

Is there anything specific?

 

Has anyone undergone a recent, post Lockdown inspection who could cast some light on any changes?

 

Cheers,

Enbiggen.

[CHiLL]

IIRC Ofsted don't really look at the systems side of IT. Last time, we made sure to have our key information, like Pupil Premium documents, certain policies, etc in an easily accessible (but secured) section of our website for the inspectors to access (we'd probably use SharePoint now). Also, we made sure that everyone had the correct DSL information on the back of their ID cards. We are overdue an Ofsted inspection, so I may not be recalling our last one very well...so there may be stuff I've forgotten or missed!

[elsiegee40]

IIRC Ofsted don't really look at the systems side of IT. Last time, we made sure to have our key information, like Pupil Premium documents, certain policies, etc in an easily accessible (but secured) section of our website for the inspectors to access (we'd probably use SharePoint now). Also, we made sure that everyone had the correct DSL information on the back of their ID cards. We are overdue an Ofsted inspection, so I may not be recalling our last one very well...so there may be stuff I've forgotten or missed!

 

I think you have misread his question… it reads to me as being about what IT resources the inspectors require in order to undertake the inspection. (Not about them inspecting infrastructure)

[ThatBoringBloke]

We gave them Wifi access for their devices and a pc with a login to the school network to access the information they required (Policies were on a shared drive at the time).

[CHiLL]

I think you have misread his question… it reads to me as being about what IT resources the inspectors require in order to undertake the inspection. (Not about them inspecting infrastructure)

Ah, sorry. That's what I was trying to get at. We didn't have to provide any resources, aside from making those documents I mentioned available online. I don't remember being asked to provide them with devices or join them to the Wi-Fi, etc.

[localzuk]

We give them Wifi access if they ask for it and that's it. They shouldn't be accessing information on your network directly (ie. having a login to get data). They should be requesting this from school staff.

[mikehollingsworth]

We were inspected last month. They just required WiFi access. Good luck!

[Boredguy]

Ours asked for Wifi Access, which had already provided, however the lead inspector ended up using her own hotspot since we block VPN connections over our BYoD network, so although she could authenticate, the VPN couldn't connect to access their systems.

 

This wasn't an issue for the other inspector who didn't have a VPN on their device.

I've had no other requests for IT access (it's been a quite couple of days )

[DaveJ2717uk]

Wifi access only and only guest Wifi access at that, access to internet nothing else was all that was requested.

[DGardiner]

Wifi access only and only guest Wifi access at that, access to internet nothing else was all that was requested.

This but i would add it needs to be non intercepted and would keep the filtering down the non negotiables

 

they need to be able to use the inspection app which runs on ms powerapps and access the portals making sure this works without intervention is probably in your best interests.

[3s-gtech]

Estyn here, but still an HMI.

 

They wanted power, a connection to a projector and that was it. Guess they did anything online via 4G or already had a corporate wifi login on our WAN.

[bushby]

inspection at one of my schools just before halfterm and only wifi access, but still ended up using hotspot as the connection kept dropping due to their location in the school

[msi_school]

When I worked in an independent school we had three ISI inspections and the ISI sent a specification of the IT access required, it wasn't much, I think guest wireless and access to a printer covered it but it was very helpful that they laid it out so clearly.

[Primus]

This but i would add it needs to be non intercepted and would keep the filtering down the non negotiables

 

they need to be able to use the inspection app which runs on ms powerapps and access the portals making sure this works without intervention is probably in your best interests.

 

And yet we've seen reports of inspectors having a list of "interesting" sites and seeing if they can get on them.

 

Anything I provided them would be exactly what I give to a normal guest - VPNs blocked, SSL interception in place and identified by individual usernames with appropriate filtering for a guest adult in a school.

 

I'm wary about trying to be "too helpful" with Ofsted.

[DGardiner]

And yet we've seen reports of inspectors having a list of "interesting" sites and seeing if they can get on them.

 

Anything I provided them would be exactly what I give to a normal guest - VPNs blocked, SSL interception in place and identified by individual usernames with appropriate filtering for a guest adult in a school.

 

I'm wary about trying to be "too helpful" with Ofsted.

 

like i said, non negotiables doesnt require context aware filtering.. cut off the blatant illegal/inapropriate content - just dont inspect it, most wont have the know how or want the inconvenience of making stuff work - some may not even have the access to their equipment to do so.

 

they need to be able to walk into the school, get given a wifi key and get on with their work.

[Primus]

like i said, non negotiables doesnt require context aware filtering.. cut off the blatant illegal/inapropriate content - just dont inspect it, most wont have the know how or want the inconvenience of making stuff work - some may not even have the access to their equipment to do so.

 

they need to be able to walk into the school, get given a wifi key and get on with their work.

 

Sorry, I don't agree, to filter effectively you need to SSL intercept.

 

As others have said, they are issued 4G hotspots and encouraged to use them if they need to, the WiFi thing is simply a courtesy we extend but you definitely don't want to hang yourself by trying to be too accommodating.

[DrBeaker]

IT provision and systems has been and had such a big impact during covid and lockdown - yet even now, Ofsted never seem bothered to ask about it?

 

e.g. How can school systems and safeguarding apps run effectively on equipment that's obsolete?

 

Very strange.

[DGardiner]

Sorry, I don't agree, to filter effectively you need to SSL intercept.

 

As others have said, they are issued 4G hotspots and encouraged to use them if they need to, the WiFi thing is simply a courtesy we extend but you definitely don't want to hang yourself by trying to be too accommodating.

 

Youre entitled to that view, our on staff hmi have told us otherwise

[Primus]

Youre entitled to that view, our on staff hmi have told us otherwise

 

Ok, is there written guidance on what Ofsted expect to be provided with?

[localzuk]

The legal requirement is that schools provide appropriate filtering and monitoring on their networks.

 

This allows some leeway in how you actually do it, and allows for you to do your own risk assessments. Eg. What are the risks involved with a guest device that's not being SSL inspected? Are children likely to see what's on the device?

 

I'd hazard that if I were doing that risk assessment, I'd not be SSL inspecting visiting Ofsted devices tbh. The risk is very low.

[DGardiner]

Ok, is there written guidance on what Ofsted expect to be provided with?

 

no idea, weve been told that on the day we must have made arrangement for ofsted to seamlessly access the internet - this would usually be by throwing up a new ssid in prepperation for their arrival with our inspection turned off and filtering reduced to our non negotiable stuff.

 

Its in your interest imo to make their visit as barrier free as possible the last thing you want to do is put a bad start on an already long day.

[Primus]

The legal requirement is that schools provide appropriate filtering and monitoring on their networks.

 

This allows some leeway in how you actually do it, and allows for you to do your own risk assessments. Eg. What are the risks involved with a guest device that's not being SSL inspected? Are children likely to see what's on the device?

 

I'd hazard that if I were doing that risk assessment, I'd not be SSL inspecting visiting Ofsted devices tbh. The risk is very low.

 

I have already pointed out the risks to giving them different access to any other guest.

[Primus]

no idea, weve been told that on the day we must have made arrangement for ofsted to seamlessly access the internet - this would usually be by throwing up a new ssid in prepperation for their arrival with our inspection turned off and filtering reduced to our non negotiable stuff.

 

Its in your interest imo to make their visit as barrier free as possible the last thing you want to do is put a bad start on an already long day.

 

Ofsted are very good at documenting their requirements but there is a whole cottage industry around "what Ofsted really mean" - much of it contributed to by Ofsted inspectors themselves sadly.

 

The School Inspection Handbook only says this:

access to wifi, if it exists, so that inspectors can connect to the internet

 

It says nothing about special SSIDs, special filtering, connecting to VPNs etc.

 

We have never ever done any of what you have suggested and I've been part of Ofsted inspections resulting in both "Outstanding" and "Good" on multiple occasions in multiple schools.

[DGardiner]

I have already pointed out the risks to giving them different access to any other guest.

 

i think you need to find a happy medium, there are "guests" and some "proffessionals" you need to make exemptions for.

 

We have nhs staff in our schools which require vpns to access what they need to do their work... i dont allow VPNs or access to any ports outside our network that arent via the proxies.

 

do i tell the nhs they cant do what they need or do i make arrangements? this is no different.

 

 

I just segregate their device and give it what it needs to function.

[Primus]

i think you need to find a happy medium, there are "guests" and some "proffessionals" you need to make exemptions for.

 

We have nhs staff in our schools which require vpns to access what they need to do their work... i dont allow VPNs or access to any ports outside our network that arent via the proxies.

 

do i tell the nhs they cant do what they need or do i make arrangements? this is no different.

 

 

I just segregate their device and give it what it needs to function.

 

No sorry, we as a MAT have made a policy decision, if you're using our connection you simply will not be using a VPN, certainly not in any sanctioned way, we will do our level best to prevent any VPN usage as far as possible.

 

All use of our connection follows age appropriate filtering but in 2021 if you're not SSL intercepting then you're not effectively filtering IMO.

 

You may think from my comments on this that I am a "blocker" not just in terms of Internet access but in terms of principle, nothing could be further from the truth.