Safeguarding Requirements
in Education
Achieving Digital Safeguarding and Cyber Resilience with Sophos

A Sophos Whitepaper. March 2024

Safeguarding Requirements in Education

Introduction
The UK Department for Education (DfE) provides statutory guidance issued
under Section 175 of the Education Act 2002 (as amended), the Education(Independent School Standards) Regulations 2014, the Non-Maintained Special
Schools (England) Regulations 2015, and the Apprenticeships, Skills, Children
and Learning Act 2009 (as amended). Schools and colleges in England musthave regard to this guidance when carrying out their duties to safeguard andpromote the welfare of children.

Ì All online devices and software must be licensed for use andshould be patched with the latest security updates.

Safeguarding the welfare of young learners and the technological solutions used
to do so must then be considered as part of the wider requirements mandated
by DfE to meet the 12 digital and technology standards in schools and colleges1,
which mandate some basic requirements on IT infrastructure to protect theeducational environment from cyber-attacks:

Ì Serious cyber attacks should be reported.

Ì “Protect all devices on every network with a properly
configured boundary or software firewall.
Ì Network devices should be known and recorded with their security
features enabled, correctly configured and kept up-to-date.
Ì Accounts should only have the access they require to perform theirrole and should be authenticated to access data and services.

Ì You should have at least 3 backup copies of important data, on
at least 2 separate devices, at least 1 must be off-site.
Ì Your business continuity and disaster recovery plan should include a
regularly tested contingency plan in response to a cyber attack.

Ì You must conduct a Data Protection Impact Assessment by statute for
personal data you hold as required by General Data Protection Regulation.
Ì Train all staff with access to school IT networks in the basics of cyber security.”DFE DIGITAL AND TECHNICAL REQUIREMENTSOPHOS RECOMMENDED SOLUTION

Protect all devices on every
network with a properly configured
boundary or software firewall.

Sophos Firewall
At school network boundary.

Network devices should be known andrecorded with their security features enabled,
correctly configured and kept up-to-date.

Sophos Firewall
At school network boundary.

Accounts should only have the access theyrequire to perform their role and should be
authenticated to access data and services.

Sophos Intercept X Advanced
Sophos XDR / MDR
Monitors event logs for user logins and canbe used to determine inappropriate use.

You should protect accounts with access topersonal or sensitive operational data andfunctions by multi-factor authentication.

Sophos XDR with Integration Pack
All Sophos solutions use multi-factor
authentication (MFA) to secure access foradministrators, and Sophos XDR and Sophos
Managed Detection and Response (MDR)
integration packs consume data from Identity
providers to help identify inappropriate use.

Ì You should protect accounts with access to personal or sensitive
operational data and functions by multi-factor authentication.
Ì You should use anti-malware software to protect all devices
in the network, including cloud-based networks.
Ì An administrator should check the security of all
applications downloaded onto a network.

1 https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges/cyber-securitystandards-for-schools-and-colleges

A Sophos Whitepaper. March 2024

Sophos Intercept X Advanced
Manage / monitor the Windows Client Firewall.

Sophos Network Detection and Response
Part of Sophos Extended Detection andResponse (XDR) and Sophos Managed
Detection and Response (MDR) licences
to identify unknown devices and provide
an intrusion prevention system to help
protect against compromise.

Safeguarding Requirements in Education

DFE DIGITAL AND TECHNICAL REQUIREMENTSOPHOS RECOMMENDED SOLUTION

You should use anti-malware software
to protect all devices in the network,
including cloud-based networks.

Sophos Intercept X Advanced
Provides industry leading threat protection for
all Windows, mac workstations and Windows
servers and Linux servers within the network or
cloud environments (such as AWS or AZURE)

An administrator should check the security of
all applications downloaded onto a network.

Sophos Firewall
Web Downloads / Application Control.
Sophos Intercept X Advanced
Manage / monitor applications throughApplication Control and Server Lockdown.

All online devices and software must be
licensed for use and should be patchedwith the latest security updates.

Sophos Firewall
Web Downloads / Application Control.

Your business continuity and disasterrecovery plan should include a regularly tested
contingency plan in response to a cyber attack.

Sophos Professional Services
Table Top Exercises to help environments
develop and test disaster recovery (DR) /incident response (IR) contingency plans.

Train all staff with access to school IT
networks in the basics of cyber security.

Sophos Phish Threat
Provides regular phishing training for staff.

Sophos Intercept X Advanced XDRCollects lists of installed applications andversions for comparison with Common
Vulnerabilities and Exposure (CVE) databases.

School governing bodies must implement solutions to comply with thesemandated requirements while also factoring in technology, policies andprocedures for safeguarding and welfare. School leaders should ensure there areappropriate policies and procedures in place for appropriate action to be taken
in a timely manner to safeguard and promote children’s welfare. These policies
should include individual schools and colleges having an effective child protection
policy which:Ì reflects reporting systems (safeguarding policies and procedures)Ì includes policies, such as online safetyÌ is reviewed annually (as a minimum) and updated if / when needed.
This white paper particularly refers to:
Department for Education Keeping Children Safe in Education (KCSIE) 20232,
published 1st September 2023; Department for Education Meeting Digital andTechnology Standards in Schools and Colleges3, published 23rd March 2022, updated
29th March 2023; and the UK Government’s Prevent Duty Guidance: England andWales (2023)4 published 2nd March 2015, Updated 14th September 2023.
The Welsh and Scottish Governments have similar legislation that is also included
within this white paper, and where applicable this document also references:
The Welsh Government Wales Safeguarding Procedures – Safeguarding Children
from Online Abuse, last updated February 20215 and Enhancing Digital Resiliencein Education6; and the Hwb Keeping Safe Online resources7 and The Wales
Safeguarding Procedures for Children and Adults at Risk of Abuse and Neglect8&9.
The Scottish Government, Education Scotland’s Child Protection and
Safeguarding Policy (Feb 2021)10; Getting it Right for Every Child (GIRFEC) andthe Children and Young People (Scotland) Act place a duty on schools and local
authorities to safeguard and promote the welfare of all children11.
The statutory guidance uses the terms “must” and “should” throughout. It uses theterm “must” when the person in question is legally required to do something and“should” when the advice set out should be followed unless there is good reason not to.

2 https://www.gov.uk/government/publications/keeping-children-safe-in-education--2
3 https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges/filtering-and-monitoringstandards-for-schools-and-colleges
4 https://www.gov.uk/government/publications/prevent-duty-guidance/prevent-duty-guidance-for-england-and-walesaccessible
5 https://safeguarding.wales/en/chi-i/chi-i-c6/c6-p6/
6 https://www.gov.wales/enhancing-digital-resilience-education
7 https://hwb.gov.wales/keeping-safe-online
8 https://safeguarding.wales/en/int-i/int-i-i1/i1-p1/
9 https://safeguarding.wales/en/chi-i/chi-i-c6/c6-p6/
10 https://education.gov.scot/media/dkxhqhwz/child-protection-and-safeguarding-policy-es-feb21.pdf
11 https://www.legislation.gov.uk/asp/2014/8/contents/enacted

A Sophos Whitepaper. March 2024

Safeguarding Requirements in Education

This white paper has been written to help schools and colleges understand thecurrent Department for Education guidance on protecting learners from online
content, and where Sophos solutions can assist. It will help the school Senior
Leadership Team (SLT), Designated Safeguarding Leader (DSL) (or DesignatedSenior / Safeguarding Person, (DSP) in Wales) and IT Teams understand what
technical solutions they require to help provide evidence to Ofsted that theeducation setting has an effective safeguarding policy and reporting procedures.
As noted above, this white paper is primarily focused on DfE and Ofsted
requirements for safeguarding. Educational establishments must also consider
the wider context of cyber security as part of their safeguarding solution toprotect other areas within the environment from physical / online attack,compromise, ransomware attack or data theft.
The amount of Personally Identifiable or Sensitive Personally Identifiable
Information held within these settings on servers, desktops, laptops, tablets,
and increasingly within public cloud infrastructure such as Azure, Amazon Web
Services (AWS), or Google Cloud is phenomenal. For example, student medical
or criminal information, scans of teachers’ passports or driver’s licences, postal
addresses, contact details for next of kin, and bank or credit card information for
cashless payments all are worth significant amounts of money to threat actors.
Schools, colleges, and higher / further education establishments are regularly
targeted by threat actors12. The recent Sophos State of Ransomware 2023 report
reveals that 80% of respondents from educational settings admitted to having atleast one ransomware attack in the last 12 months.
Looking specifically at education environments, 36% of the attacks came fromcompromised credentials, 29% from the exploitation of vulnerabilities, and 19%
from malicious emails. Looking back to the DfE 12 standards, these are areasthat are mostly covered by the requirements set out in this document.

12 https://www.sophos.com/en-us/content/state-of-ransomware

A Sophos Whitepaper. March 2024

Threat actors operate 24x7, however IT support in most educational
establishments operates office hours with very limited support out of hours, overweekends, or during holidays. This leaves the computing estate vulnerable tocompromise, data theft, and ransomware while left effectively unattended.
According to research by Gartner and industry analysts, for effective cyber security
at least five dedicated threat hunters are required to provide true 24x7x365
coverage within a security operations team. This is in addition to the IT staff
required for business-as-usual activities.
Most environments typically have at least 10 separate point solutions used insome capacity for cyber security – endpoint protection, patching, MFA, unified
endpoint management (UEM) / mobile device management (MDM), Microsoft 365,
firewall, zero trust network access (ZTNA) / virtual private network (VPN), network
monitoring, System Center Configuration Manager (SCCM) / Active Directory (AD)etc. Unfortunately, in 2023/24 these solutions typically result in log overload.
Over the last few years, many companies have seen security information andevent management (SIEM) solutions as the answer, with their expensive ability
to consume logs in lots of different formats and little to no ability to normalize or
standardize into a common format. As a result, they are great at consuming data
but less effective at cyber security and hunting for signs of compromise.
The only viable option is a truly integrated solution, such as Sophos Central. It
allows the use of different protection products (depending on the licence) whileproviding a central secure data lake. This allows for a common data structure andintelligent threat hunting of suspicious indicators of compromise or unaccountable
events, regardless of whether the event is email, endpoint, identity, firewall,
network or Microsoft 365 / public cloud-based. Educational establishments needto consider a holistic integrated approach not only to safeguarding but also tocyber security and threat protection.

Safeguarding Requirements in Education

The Education Inspection Framework
The Education Inspection Framework13 and Ofsted Inspection Handbook14 setsout how Ofsted inspects maintained schools, academies, non-association
independent schools, and further education institutions in England. The
Independent Schools Inspectorate (ISI)’s inspection framework sets out how it
inspects independent schools in England, including residential (boarding) schools
and registered early years settings:“34. We expect schools to meet the other requirements of Keeping children safe ineducation, but have no additional or separate expectations of schools concerning:Ì using a digital platform to monitor pupils’ internet use, and we
do not specify how these platforms should operate.
[…]
378. All schools should have an open and positive culture around safeguardingthat puts pupils’ interests first. This means they:Ì protect pupils from serious harm, both online and offline
Ì are vigilant, maintaining an attitude of ‘it could happen here’Ì are open and transparent, sharing information with others
and actively seeking expert advice when requiredÌ ensure that all those who work with pupils are trained well sothat they understand their responsibilities and the systems
and processes that the school operates and are empoweredto ‘speak out’ where there may be concerns
Ì actively seek and listen to the views and experiences ofpupils, staff, and parents, taking prompt but proportionate
action to address any concerns, where needed

13 https://www.gov.uk/government/publications/education-inspection-framework
14 https://www.gov.uk/government/publications/school-inspection-handbook-eif/school-inspection-handbook-forseptember-2023

A Sophos Whitepaper. March 2024

Ì have appropriate child protection arrangements, which:Ì identify pupils who may need early help, and who are at
risk of harm or have been harmed. This can include but
is not limited to, neglect, abuse (including by their peers),
grooming, exploitation, sexual abuse, and online harmÌ secure the help that pupils need and, if required, refer in atimely way to those who have the expertise to helpÌ manage safe recruitment and allegations about
adults who may be a risk to pupils
Ì are receptive to challenge and reflective of their own
practices to ensure that safeguarding policies, systems
and processes are kept under continuous review.
[…]419. Inspectors will always consider the effectiveness of the school’s
safeguarding.”14
Prevent Duty
Inspectors will evaluate the extent to which the setting has a culture ofsafeguarding that supports effective arrangements to identify learners who
may need early help or who are at risk of harm or exploitation, including
radicalization. For Ofsted and ISI, this forms part of the leadership andmanagement judgment. Governors, in particular, must ensure that theschool’s arrangements for safeguarding meet statutory requirements.

Safeguarding Requirements in Education

Achieving Digital Online Safeguarding
Keeping Children Safe in Education (KCSIE) 2023
It is essential that children are safeguarded from potentially harmful andinappropriate online material. An effective approach to online safety empowers
a school or college to protect and educate pupils, students, and staff in their useof technology and establishes mechanisms to identify, intervene in, and escalate
any concerns where appropriate.
Increasingly with remote settings (for example remote learning during Covid),schools and colleges need to consider the safety of pupils, students, and staff
while remote learning. Technologies like client-based web filtering and zero trust
networking can assist with building a robust cyber security policy.
Filtering and monitoring are a fundamental responsibility to safeguard and limit
children’s exposure to the four categories of risk (Content, Contact, Conduct, andCommerce – 4Cs). As part of this process, governing bodies should ensure theirschool or college has appropriate filtering and monitoring systems in place andregularly review their effectiveness.
The appropriateness of any filtering and monitoring systems is a matterfor individual schools and colleges and will be informed, in part, by the risk
assessment required by the Prevent guidelines. However, schools and collegesmust have effective monitoring strategies in place that meet their safeguardingneeds.
Ninety percent of all network and internet traffic is encrypted. To comply with
DfE guidelines both HTTP and HTTPS filtering must be carried out to ensure that
effective filtering and monitoring is achieved.
To support schools and colleges, the DfE has published the Filtering andMonitoring Standards Additional guidance on “appropriate” filtering andmonitoring can be found at: UK Safer Internet Centre15 and in particular the
Sophos Firewall 2023 Vendor Response16.

15 https://saferinternet.org.uk/guide-and-resource/teachers-and-school-staff/appropriate-filtering-and-monitoring16 https://d1xsi6mgo67kia.cloudfront.net/uploads/2022/12/Sophos-Appropriate-Filtering-Provider-ResponseSophos-2023.pdf

A Sophos Whitepaper. March 2024

KCSIE 2023 Appendix B also contains a section relating to cybercrime andhighlighting the impact on education settings or third parties where computers
can be used to compromise computer networks / corporate environments.
Schools and colleges contain a significant volume of Personally Identifiable
or Sensitive Personally Identifiable Information (for example student medical
records, copies of passport / driving licence details for teachers or staff who
may drive the school minibus, or arrange activities such as trips abroad).
Educational establishments are regularly targeted by threat actors and requirea robust 24x7 detection and response system, such as Sophos Managed
Detection and Response as part of their cyber risk mitigation strategy.
The Prevent Duty should be seen as part of schools’ and colleges’ wider
safeguarding obligations. The guidance is set out in terms of four generalthemes: risk assessment, working in partnership, staff training, and IT policies.

Filtering and monitoring standards forschools and colleges
Schools and colleges should provide a safe environment, including when online.
Filtering and monitoring are both important parts of safeguarding pupils andstaff from potentially harmful and inappropriate online material.
There are several technical requirements that the Senior Leadership Team (SLT)is responsible for:
Ì procuring filtering and monitoring systems
Ì documenting decisions on what is blocked or allowed and whyÌ reviewing the effectiveness of the provisionÌ overseeing reports.

Safeguarding Requirements in Education

The SLT should work closely with the Designated Safeguarding Leader (DSL) andIT providers in all aspects of creating a robust filtering and monitoring policy within
the educational setting. As part of these requirements training may be required by
the DSL and IT Team to ensure that the filtering solution is set up and configured
correctly.
The DSL should take lead responsibility for safeguarding and online safety, which
could include overseeing and acting on:Ì filtering and monitoring reports
Ì safeguarding concernsÌ checks to filtering and monitoring systems.

Sophos Compliance Status: Fully Compliant
Guest users are users who don’t have an account within the school’s User
Authentication Directory (Microsoft AD or Azure AD or locally within thefirewall) and want to connect to your school network to access the internet.
You can register guest users or allow them to register through the guest user
portal. You can print credentials or send them through SMS.
After authentication, the guest user is granted access according to theselected policies or is redirected to the Sophos Firewall captive portal. Thisis a web page that requires users behind the firewall to authenticate whenattempting to access a website or the internet.
Ì school owned devices

The IT service provider should have technical responsibility for:
Ì maintaining filtering and monitoring systems
Ì providing filtering and monitoring reports
Ì completing actions following concerns or checks to systems.
The IT service provider should work with the SLT and DSL to:Ì procure systems
Ì identify risk
Ì carry out reviews
Ì carry out checks.
The filtering system should be operational, up to date, and applied to all:Ì users, including guest accounts

A Sophos Whitepaper. March 2024

Sophos Compliance Status: Fully Compliant
Sophos Firewall supports both NTLM (NT LAN Manager) and Kerberos
authentication.
Sophos Transparent Authentication Suite (STAS) enables users on a Windows
domain to sign in to Sophos Firewall automatically when signing in toWindows. This eliminates the need for multiple sign-ins and for single sign-on(SSO) clients on each client device.
For customers using the Sophos Intercept X Advanced endpoint protection
client, the Security Heartbeat is also available as a user authentication method.
When a user signs in to an endpoint, Security Heartbeat sends a synchronizeduser ID containing the domain name and username to Sophos Firewall. Sophos
Firewall checks the user account with the configured Active Directory server
and activates the user.
Ì devices using the school broadband connectionSafeguarding Requirements in Education

Sophos Compliance Status: Fully Compliant
The Sophos Firewall typically sits on the boundary between the internet /internet service provider (ISP) connection and the educational establishment’s
internal networks and demilitarized zone (DMZ).
All IPv4 and IPv6-based network traffic is then filtered at this point as per thepolicies set within the Firewall for inbound / outbound traffic.
Your filtering system should:
Ì filter all internet feeds, including any backup connections
Sophos Compliance Status: Fully Compliant
Sophos Firewall typically sits on the boundary between the internet / ISP
connection and the educational establishment’s internal networks and DMZ.
All IPv4 and IPv6-based network traffic is then filtered at this point as per thepolicies set within the Firewall for inbound / outbound traffic.
Sophos Firewall also natively supports Transport Layer Security (TLS) 1.3,
providing a robust filtering solution for the latest HTTPS encryption andcyphers, and mobile device certificate pinning.
Ì be age and ability appropriate for the users, andbe suitable for educational settings
Sophos Compliance Status: Fully Compliant
The flexible nature of the web filtering policies within the Sophos Firewall
allows educational settings to set up and apply specific policies to different
users, groups of users, or devices, allowing granular policy controls to be
configured as appropriate to age and educational learning requirements.
Ì handle multilingual web content, images, common
misspellings, and abbreviations

A Sophos Whitepaper. March 2024

Sophos Compliance Status: Fully Compliant
Sophos produces and sells Sophos Firewall around the world and will fully
support multilingual web content, images, misspellings, and abbreviations.
The management console supports administration in Default English, Chinese
Simplified, Chinese Traditional, Hindi, French, German, Italian, Korean, andBrazilian Portuguese.
Ì identify technologies and techniques that allow users to get aroundthe filtering such as VPNs and proxy services and block them
Sophos Compliance Status: Fully Compliant
Sophos Firewall is designed as an industry-leading cyber security solution that
includes many web browsing categories, including anonymizing web proxies.
Within application control, you can also apply bandwidth restrictions andrestrict traffic from applications (such as VPN) which can be used to bypass
security / safeguarding protections or lower productivity. Application
filters allow you to control traffic by category or on an individual basis. Withsynchronized application control, you can restrict traffic on endpoints thatare managed with Sophos Central. Managing cloud application traffic is also
supported.
Ì provide alerts when any web content has been blocked
Sophos Compliance Status: Fully Compliant
Sophos Firewall includes real-time in-depth reporting and scheduled email
alerting to provide DSL and IT Teams with alerts relating to search engine use,
blocked web attempts, web content, etc.
Granular Role Based Administration on the Firewall allows DSLs to be set up
with a limited “Firewall Audit” Administration role, which allows access to realtime logs and reporting if required by the educational setting’s safeguarding
policy.

Safeguarding Requirements in Education

Mobile and app content is often presented in a different way to web browser
content. If your users access content in this way, you should get confirmationfrom your provider as to whether they can provide filtering on mobile or app
technologies. A technical monitoring system should be applied to devices using
mobile or app content to reduce the risk of harm.
Sophos Compliance Status: Fully Compliant
Sophos Firewall also natively supports TLS 1.3, therefore providing a robust
filtering solution for the latest HTTPS encryption and cyphers, and mobile
content provided to devices using certificate pinning.
It is important to be able to identify individuals who might be trying to accessunsuitable or illegal material so they can be supported by appropriate staff, suchas the SLT or the DSL.
Your filtering systems should allow you to identify:
Ì device name or ID, IP address, and where possible, the individual
Sophos Compliance Status: Fully Compliant
The logging within the Sophos Firewall includes the user information, device
details, and IP address.
Ì the time and date of attempted access
Sophos Compliance Status: Fully Compliant
All logging and reporting data is date and time-based.
Ì the search term or content being blocked

A Sophos Whitepaper. March 2024

Sophos Compliance Status: Fully Compliant
The Sophos Firewall includes real-time in-depth reporting and scheduled email
alerting to provide DSL and IT Teams with alerts relating to search engine use,
blocked web attempts, web content, etc.
Granular Role Based Administration on the Firewall allows for DSLs to be set up
with a limited “Firewall Audit” Administration role, which allows access to realtime logs and reporting if required by the educational setting’s safeguarding
policy.

Safeguarding Requirements in Education

Conclusion
Sophos offers a complete cyber security solution for customers in all sectors
to protect them from modern cyber threats. It also offers a single platform forextended detection and response – the Sophos delivered Managed Detection andResponse services – which will help educational establishments meet the 12 DfE
cyber security / technology requirements, helping to reduce any cyber insurance
costs while also meeting the DfE requirements for safeguarding children ineducation.
Sophos Firewall is an industry-leading cyber security solution. It fully complies with
the UK Department for Education KCSIE 2023, Prevent Duty and DfE Filtering andMonitoring requirements needed by educational settings to safeguard learners frominappropriate material (4Cs).
As an integral part of the Sophos Cybersecurity Ecosystem, Sophos Firewall isavailable as a clustered solution and will fully integrate into the Sophos Central
Management platform to provide a single, integrated solution for all educational
environment cyber security needs.
Increasingly, cyber attackers operate 24x7, so a truly integrated solution with theoption of Sophos Managed Detection and Response provides customers with thereassurance that over 500 Sophos Threat Experts are watching over the securityof their environments and preventing compromise from hackers, ransomware, or
malware – all while safeguarding learners from accessing inappropriate websites,
web content, or applications.

Gartner does not endorse any vendor, product or service depicted in its research publications and does notadvise technology users to select only those vendors with the highest ratings or other designation. Gartner
research publications consist of the opinions of Gartner’s Research & Advisory organization and should not
be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect tothis research, including any warranties of merchantability or fitness for a particular purpose.
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. andinternationally, MAGIC QUADRANT and PEER INSIGHTS are registered trademarks of Gartner, Inc. and/or its
affiliates and are used herein with permission. All rights reserved.

© Copyright 2024. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2024-03-08 (WP-NP)

Gartner Peer Insights content consists of the opinions of individual end users based on their own
experiences with the vendors listed on the platform, should not be construed as statements of fact, nor dothey represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service
depicted in this content nor makes any warranties, expressed or implied, with respect to this content,
about its accuracy or completeness, including any warranties of merchantability or fitness for a particularpurpose.