For education sector bodies that suffer a security incident, the Whitehall department offers support services including an insurance scheme with cyber cover and a team to assist with emergency response

The Department for Education has been alerted to more than 50 ransomware attacks suffered by schools and other institutions since 2022.

According to early education minister Stephen Morgan, schools manage their own tech and security infrastructure and “there is currently no mandatory reporting requirement legislation for schools to report a cyberattack and no central register of cyberattacks” across the sector is kept by the department.

“However, the department has been notified of 53 ransomware cases across the sector over the last three years,” the minister added, in response to a written parliamentary question from fellow Labour MP Luke Charters.

Schools seeking to mitigate the risks posed by cyberthreats are able to sign up for the DfE’s Risk Protection Arrangement (RPA) – effectively a government-backed insurance scheme which, since the 2022/23 year, “offers cover for cyber incidents as standard”, according to Morgan.

Related content

• DfE boosts security with £6m deal for ‘cyber specialists’
• Cancelled appointments top 6,000 but NHS claims most services now ‘near normal’ after cyberattack
• DfE signs new £77.5m Microsoft cloud deal

“In the event of a cyber incident, RPA members have access to a 24/7 incident response service,” the minister said.

The DfE indicates that there are currently 9,900 member institutions, representing 52% of all eligible schools.

Morgan added: “The department’s dedicated sector cybersecurity function provides advice in response to cybersecurity enquiries and incident reports from the sector, liaising with the affected institution following an incident to advise on steps to mitigate the threat and provide guidance on recovery. The department adheres to the NCSC guidance on payment of ransoms and does not encourage, endorse nor condone the payment of ransom demands in response to a ransomware attack.”

To help promote good security hygiene and best practice among schools, the DfE operates “a small, dedicated sector cybersecurity team to support the education sector”, Morgan said.

“The team provides appropriate guidance and advice, via regular targeted and broad communications, to help schools adhere to and maintain good cybersecurity standards,” he added. “The department provides guidance for schools and colleges on how to help protect against a cyber incident.”