Section 9: Additional insights and attestation
These questions are not from IASME. They relate to the pilot and help us learn more about schools and how we can support them.
The 3-2-1 rule means keeping at least 3 copies of your data, on 2 different devices or types of storage, with 1 copy off-site.
NCSC adds an offline rule:
- keep at least one backup disconnected from your network so that ransomware cannot reach it
- make sure backups are taken regularly
Backing up is not a Cyber Essentials technical requirement, but NCSC highly recommends it (Requirements v3.3, page 5).
This question is added by this questionnaire and is not an IASME question.
A cyber incident response plan says what to do, who does it and who to tell if your systems are attacked or data is lost.
NCSC's Response and Recovery guide covers preparing, identifying what is happening, resolving the incident, reporting it and learning lessons.
Make sure you can still access your plan if school systems are down, and practice it: NCSC's free Exercise in a Box lets you test your response.
You can report a cyber incident at report.ncsc.gov.uk. Governors and trustees can use the incident planning section of NCSC's Board Toolkit. This question is added by this questionnaire and is not an IASME question.
An information security policy is a short, written statement of:
- how your school protects its information and systems
- who is responsible
- what staff must do, such as acceptable use, passwords and reporting problems
Leaders should approve it, staff should be told about it, and it should be reviewed regularly. IASME offers free policy templates through its Cyber Assurance scheme, and NCSC's Cyber security for schools page has resources for staff and leaders.
This question is added by this questionnaire and is not an IASME question.
A risk management framework is a regular, repeatable way to:
- identify cyber security risks
- decide who owns each one
- decide what to do about risks
- report to governors or trustees
A simple risk register is a good start. NCSC's risk management guidance sets out a framework of high-level steps, and its questions for governors and trustees help boards ask the right things. This question is added by this questionnaire and is not an IASME question.
An asset register is a list of assets (devices such as computers, laptops, tablets, servers and network equipment), plus software and cloud services. It records where they are and who is responsible for them.
Asset management is not one of the 5 Cyber Essentials controls, but IASME says it helps you meet all of them, including knowing when something reaches end of support.
NCSC says good asset management means keeping accurate information that you actually use, not lists that are never looked at (Requirements v3.3, page 7). IASME suggests asking your school business manager whether you already have one, as it may also be an insurance requirement.
This question is added by this questionnaire and is not an IASME question.
A supplier register lists companies that provide services touching your school's data or systems, such as your:
- IT support provider
- broadband provider
- MIS and cloud services
It lists what each does for you, and a contact. NCSC's supply chain advice starts with understanding your suppliers, including everyday suppliers such as cloud providers. Its supplier assessment guidance begins with building a register of all suppliers. If a supplier manages your IT or firewall, the responsibility for the controls still lies with the school (see 2.11).
This question is added by this questionnaire and is not an IASME question.
Someone senior (for example, at board level, a headteacher, trust CEO or governor) must approve the final declaration.
Did you find what you needed?
Fill in our 3 question survey and let us know if you need more help.