DfE Cyber Security Standards, KCSIE compliance, and related guidance significantly increasing costs?

[JazzFlute]

I'm interested in School Savings in general when trying to meet all the recommendations and guidelines.

 

Working through DFE Guidance for schools and colleges which they expect everybody to follow by 2030 as well as trying to be compliant with KCSIE and all this entails like cloud back up, Internet, internet back up lines, and the long list that all this entails has anyone saved any money or recommend anything best value they have purchased which make you compliant.

 

For instance, Monitoring, I use Securus…great product and installs easily and flags up websites to block if not already, gives you an idea of offline behaviour as it captures real time typing violations etc. and much more but can I save the £800 per year and just instead ask classroom staff “to look over students shoulders” when they are using devices to tick the monitoring box which I believe is a “solution”  Are you binning things off so you can afford to be compliant with the other things needed?

 

The list goes on for anything in IT in general in a school and be interested in what saving are to be had.  Just purchased Redstor Cloud back up for Microsoft Tenant which is nearly £2,000 extra sub this year and moving forward every year.  It seems all this guidance is costing a lot of money to comply with.

 

Responsibility

Do MSP’s advise schools on this or do they just wait for instruction from the school leaders?

Do locally employed school IT Staff advise school leaders?

Do Trust IT Staff wait for instructions from the "top" and is it then the trusts responsibility or is this responsibility passed down to the IT Staff supporting the schools?

 

[nicholab]

If you listen to the NCSC podcast, school leaders should have wanted to do Cyber Essentials anyway.  It would have shown a comment to cybersecurity.  It is somewhat like tax you have to pay it as an employer so get over  The other alternative is providing a standardized school system that schools could buy.  It would actually be helpful if a security configuration template existed for schools and was provided by the NCSC.

[itskdog]

We have LGfL as our ISP, so we get Senso Safeguard Cloud (monitoring), Sophos Intercept X (antivirus), Redstor Total Education Bundle (unlimited backup), and MalwareBytes Threatdown (anti-malware), plus a managed service of Netsweeper they call SchoolProtect (network filtering including HTTPS inspection) and HomeProtect (client filtering for 1:1 devices when off-site), and a redundant internet connection, all included free with our internet plan. (Redstor only comes free with a 5-year commitment, otherwise it's just discounted from the RRP). They also have a managed Exchange server and RDP gateway, but we don't use those.

 

When we last had a major physical infrastructure upgrade (alongside migrating our email from LGfL to Office 365), our we did look at what the cost would be going direct to VMB for the same bandwidth we were upgrading to, and the price was not too much less when you consider we'd then have to buy all the extras ourselves, and that was just for internet without any of the extras, and the annual price hasn't risen by too much since then (IIRC we pay about £12k pa for a 1Gbps line + 400Mbps resilient)

[Koldov]

1 hour ago, itskdog said:

We have LGfL as our ISP, so we get Redstor Total Education Bundle (unlimited backup).... --- snip --- ...and a redundant internet connection, all included free with our internet plan.

 

 

I don't remember being offered those two from LGfL!

[Cat_Jam148]

4 minutes ago, Koldov said:

 

 

I don't remember being offered those two from LGfL!

 

Neither do I! 

 

I enquired about the redundant internet awhile ago and there was a charge for us...

Edited November 28, 2025 by Cat_Jam148

[itskdog]

8 minutes ago, Koldov said:

 

 

I don't remember being offered those two from LGfL!

 

They're both recent additions in the last year or two. We were previously paying extra for resilient BT DSL, but then they made a load of noise about providing resilient fibre to all their schools, so we got upgraded from BT copper to Community Fibre (who knocked down one of our APs when running the cable through the building to our server room, and didn't tell us it was very visibly damaged. Luckily for us they plugged it back in to the non-PoE port so it showed as offline in the Meraki dashboard)

Edited November 28, 2025 by itskdog

[sigma]

Plus 1 for LGfl and the really useful inclusive bundle of products and services which has amounted to substantial savings compared to buying everything separately.  
 

[DrBeaker]

21 minutes ago, sigma said:

Plus 1 for LGfl and the really useful inclusive bundle of products and services which has amounted to substantial savings compared to buying everything separately.  
 

 

But how long until THEY do the same as others and raise prices in saying 3-5x years?

[nicholab]

I found LGFL limited in that you could not have a direct connection but that was 13 years ago.

[Zoom7000]

6 hours ago, DrBeaker said:

 

But how long until THEY do the same as others and raise prices in saying 3-5x years?

 

They regularly advertise that they haven't raised prices in year. Having been an LGfL customer since 2004, I think the added value is phenomenal. 

 

6 hours ago, nicholab said:

I found LGFL limited in that you could not have a direct connection but that was 13 years ago.

 

You can actually. You can go for something called option 2. But the question is, why would you want to?

[nicholab]

I think this was actually 2010, 15 years ago.  We wanted to provide access to any internal services at the time we had onsite Exchange and CMIS.   This is less of an issue now with things like Office 365 and G suite.

[Roberto]

On 28/11/2025 at 10:54, JazzFlute said:

Working through DFE Guidance for schools and colleges which they expect everybody to follow by 2030 as well as trying to be compliant with KCSIE and all this entails like cloud back up, Internet, internet back up lines, and the long list that all this entails has anyone saved any money or recommend anything best value they have purchased which make you compliant.

 

For instance, Monitoring, I use Securus…great product and installs easily and flags up websites to block if not already, gives you an idea of offline behaviour as it captures real time typing violations etc. and much more but can I save the £800 per year and just instead ask classroom staff “to look over students shoulders” when they are using devices to tick the monitoring box which I believe is a “solution”  Are you binning things off so you can afford to be compliant with the other things needed?

 

KCSIE isn't new. I was worried about that back when I worked in education which is starting to be a good while ago.

 

With regards to the costs of things, I know many schools are seriously financially constrained but, picking on your example above, I'd say £800 a year to keep my then employer off the front pages of the paper tabloids and websites like the register for the wrong reasons was excellent value for money. I'd be thinking about whether you could consolidate a few services either with a current supplier or a new one to reduce complexity and hopefully costs as per the LGFL example others mentioned.

[JazzFlute]

10 minutes ago, Roberto said:

 

KCSIE isn't new. I was worried about that back when I worked in education which is starting to be a good while ago.

 

With regards to the costs of things, I know many schools are seriously financially constrained but, picking on your example above, I'd say £800 a year to keep my then employer off the front pages of the paper tabloids and websites like the register for the wrong reasons was excellent value for money. I'd be thinking about whether you could consolidate a few services either with a current supplier or a new one to reduce complexity and hopefully costs as per the LGFL example others mentioned.

 

Yes KCSIE isn't new but it seems the latest few revisions/updates require IT expenditure which some school leaders aren't aware of or maybe think they can be achieved without spending money so when you ask them for things like a 2nd internet line, back ups for your Microsoft/Google tenant then it becomes a new ongoing yearly cost and a question if you can "save" elsewhere.  Personally I think anything to comply with KCSIE and DFE recommendations are not "optional extras" but should be considered in the schools budget and included in the running of the school and are non-negotiable operational costs and not to pay for it all by moving backwards and using IT to pay for it by scrapping systems which benefit the school so you end up just paying for the Core things needed and any "extras" are unaffordable.

 

I'm just working on a document so school leaders are aware of what we need to comply by 2030 (Internet redundancy, cloud Microsoft Backups etc.) so they are aware these are not "extras" but what is needed and need to be budgeted for yearly.

[Chockster]

We'd need triple the budget to even get near the DFE standards. 40gig interconnects and dual fibre runs are a pipe dream (and in a building from 1958, there are a lot of pipes to get in the way.)

 

I'd love to think they were being aspirational, but fear it's just so they can say "that cyber attack was your fault, as you didn't keep up to our specs" and wipe their hands of any responsibility.

[JazzFlute]

12 minutes ago, Chockster said:

We'd need triple the budget to even get near the DFE standards. 40gig interconnects and dual fibre runs are a pipe dream (and in a building from 1958, there are a lot of pipes to get in the way.)

 

I'd love to think they were being aspirational, but fear it's just so they can say "that cyber attack was your fault, as you didn't keep up to our specs" and wipe their hands of any responsibility.

 

Exactly this! those that missed out or didn't qualify for the latest CTC to upgrade switches/Wi-Fi etc. depending on school size having to find anything from £40,000 for a primary to the maximum allowed for secondary schools.  These expectations and costs are massive when i imagine a lot of schools are still rolling out new Windows 11 devices in the next few years which probably cost them a fortune on top of everything else.

 

I get the impression schools are cutting back on local IT staff/hours or paying lower to help with these costs when if anything more skill/expertise is required to implement these changes.

[Roberto]

27 minutes ago, Chockster said:

We'd need triple the budget to even get near the DFE standards. 40gig interconnects and dual fibre runs are a pipe dream (and in a building from 1958, there are a lot of pipes to get in the way.)

 

I'd love to think they were being aspirational, but fear it's just so they can say "that cyber attack was your fault, as you didn't keep up to our specs" and wipe their hands of any responsibility.

Requirements without the resources to back them up are just empty words right? I reckon we can all agree with that. It's at least blind optimism even if it is meant in good faith.

[Davit2005]

On 28/11/2025 at 23:55, Zoom7000 said:

 

They regularly advertise that they haven't raised prices in year. Having been an LGfL customer since 2004, I think the added value is phenomenal. 

 

 

You can actually. You can go for something called option 2. But the question is, why would you want to?

Flexibility would be an option. Flexibility to be in charge of your own firewall, flexibility on Internal IP ranges, etc. 🙂

[paulkerton]

On 28/11/2025 at 13:05, nicholab said:

 It would actually be helpful if a security configuration template existed for schools and was provided by the NCSC.

I get what you're saying, but at the same time a security configuration template for schools to help them lock things down, is also a map to guide malicious actors to be able to find issues.

[loxford01]

One of the DFE standards is to appoint a member from the senior leadership team as a Digital IT lead by 2030 and who must have oversight of all digital tech, create and manage a digital tech strategy. I wonder how well this will work out as they will also be reviewing the effectiveness of IT support and recommending actions for improvement. 

 

 

[paulkerton]

16 minutes ago, loxford01 said:

One of the DFE standards is to appoint a member from the senior leadership team as a Digital IT lead by 2030 and who must have oversight of all digital tech, create and manage a digital tech strategy. I wonder how well this will work out as they will also be reviewing the effectiveness of IT support and recommending actions for improvement. 

 

 

I wish I could feel surprised that even the DfE have a "teacher knows best" attitude.