Academy Trust Technology Briefing: Autumn 2026
Three pieces of government policy came into effect within five weeks of each other this term, and each one reaches the board table. This briefing sets out what has changed, what it requires, and the questions worth asking your team, in plain language for trust leaders.
Why this autumn is different
Most years, technology guidance arrives as advice. This autumn, more of it has arrived as obligation. Keeping Children Safe in Education 2026 has been in force since 1 September. The statutory mobile phones guidance has applied from the same day. The Academy Trust Handbook 2026 took effect on 1 October, and for the first time it reaches directly into your technology contracts. None of this requires panic. All of it requires a named owner, a date in the diary, and evidence you can show when asked.
The Academy Trust Handbook reaches your technology estate
Two changes matter most to trust executives, and one of them now sets the shape of every MIS procurement.
Your MIS contract now has rules
From this edition, the Handbook sets out how every Management Information System contract must be procured around the DfE's planned MIS framework, due to launch in September 2027. Until the framework launches, any extension to an existing MIS contract must be for no more than twelve months, and any re-procurement must include the DfE's MIS Core Principles in its requirements. Once the framework launches, trusts must award their next MIS contract under it as soon as practicable and in line with the expiry of the current contract, and must not use extension options that delay that transition.
The practical action is simple and worth doing this month: list every MIS contract across the trust with its end date and extension clauses, and mark which ones expire before and after September 2027, because the rules differ on each side of that date.
Buying decisions must now be recorded
Trusts must consider DfE purchasing opportunities when buying goods and services, and must record their decision-making. For technology that means every significant purchase needs a documented check against the DfE's recommended deals, even where you buy elsewhere for good reason. The requirement is not to buy through DfE routes; it is to show you looked.
Cyber belongs on the board's risk register
The handbook is explicit that risk management covers the full operations of the trust, not only financial risk, that the board retains ultimate oversight of the risk register, and that contingency and business continuity planning is a requirement. A cyber incident is the clearest test of all three. If your register does not yet carry cyber risk with a named owner and a tested continuity plan behind it, that is the gap to close first.
The 2030 clock is in the handbook now
Trusts should be working towards the DfE's six core digital and technology standards by 2030: broadband, wireless, network switching, digital leadership and governance, filtering and monitoring, and cyber security. One of the six is not a 2030 target: the handbook states that trusts are expected to be meeting the filtering and monitoring standard already, because it is anchored in statutory safeguarding guidance.
Safeguarding: two changes in force from the first day of term
Every member of staff now reads Part One
Keeping Children Safe in Education 2026 is in force from 1 September. The shorter Annex A has been removed, so all staff, including those who do not work directly with children, now follow the same safeguarding expectations and read Part One in full. The filtering and monitoring duties continue: assigned roles across a senior leader, a governor, the Designated Safeguarding Lead (DSL) and IT support, a documented review at least annually, and systems whose safeguarding blocklists cannot be switched off by anyone, at any level.
Worth noting for this year's review: the standard now asks every school to consider whether its filtering can handle real-time, dynamic, personalised and AI-generated content, and since August it refers schools introducing generative AI products to the DfE's generative AI product safety standards.
Phone-free by default is now statutory guidance
The mobile phones guidance became statutory in June and schools should follow it from 1 September: mobile phone-free throughout the school day by default, with anything else by exception. For trusts the technology consequences are practical: your bring your own device (BYOD) policy should not include mobile phones, your acceptable use and behaviour policies need to align, and filtering and monitoring on school-managed devices carries more of the safeguarding load once pupils' own devices are out of the picture.
The cyber standard is written as now, not 2030
The cyber security core standard sits under the 2030 banner, but nearly every line of it says already. Five of its requirements are worth an executive's attention because they are specific, checkable, and in some cases conditions of your insurance.
MFA is a must
Multi-factor authentication must be enabled for every staff account with access to cloud services or remote access, and for every IT administrative account.
Backups: three copies, one immutable
At least three copies of important data on at least two devices, one off-site, immutable, tested and logged termly. For trusts in the risk protection arrangement, backing up to this level is a condition of cover.
Fourteen days to patch
Critical and high-severity vulnerability fixes must be applied within fourteen days of release, and DfE-issued security instructions within five working days.
Training reaches the board
Cyber training at least annually for staff, and for at least one current governor or trustee. RPA members must evidence annual National Cyber Security Centre (NCSC) training.
A tested response plan
A cyber response plan within your business continuity planning is expected, and it is a condition of RPA cover. High-risk data breaches go to the Information Commissioner's Office (ICO) within 72 hours.
An annual risk assessment
A cyber risk assessment completed annually and revisited every term, with the results feeding the board's risk register.
Five questions worth asking
When does each of our MIS contracts end, and does it fall before or after the planned framework launch in September 2027? Where is cyber on our risk register, who owns it, and when was the continuity plan behind it last tested? Can we evidence our filtering and monitoring review for this academic year, with the named senior leader and governor? Are we recording purchasing decisions against DfE opportunities, as required since 1 October? And would we currently satisfy the conditions of our RPA or cyber insurance cover: the backups, the training, the response plan?
A team that can answer all five from evidence, not memory, is in good shape for the year. Gaps are normal; unowned gaps are the risk.
Evidence, not just assurance
Everything above ends in the same place: being able to show your position rather than assert it. That is the shape of the services we run for trusts.
Cyber Readiness
A structured assessment against the DfE standards and NCSC guidance: where you stand, what to fix first, and the evidence for governors and insurers. Start with our free self-assessment.
Explore Cyber Readiness
Filtering and Monitoring
KCSIE-aligned filtering and monitoring with DSL dashboards and audit trails, reviewed with you annually, so the safeguarding review writes itself.
Explore Filtering and Monitoring
Managed IT for Trusts
MFA enforced, critical patches inside fourteen days, immutable backups verified, and a named Service Delivery Manager reporting to your rhythm, trust-wide.
Explore Managed ITRead the guidance in full
This briefing summarises the following Department for Education publications, correct as at 22 October 2026: Academy Trust Handbook 2026; Keeping Children Safe in Education 2026; Mobile phones in schools (statutory guidance); Meeting digital and technology standards, including the filtering and monitoring and cyber security core standards.
Talk this through with us
Thirty minutes with our team will tell you where your trust stands against the autumn changes and what, if anything, needs to move first. No obligation, and you keep the notes.