Local authority auditors normally ask about data security, mobile devices, memory sticks security and disaster recovery etc.
Talk to your Data Protection Officer (usually the Bursar or Head).
Sounds like your in the Primary sector, but Data security and high risk of data loss due to hard drive failure etc should be good buttons to push?