The school cyber risk assessment: how to write one governors can use

Most schools have a list of things to fix. Fewer have a document a governing body can hold somebody to: each risk named, owned by a person, scored, and reviewed on a date. That second thing is the risk assessment, and it is what an insurer, an auditor and a trust board all ask for.

A checklist is not a risk assessment

A checklist answers what should we do. A risk assessment answers what could go wrong here, how bad would it be, who owns it, and when do we look again. You need both, and they are different documents. If you only have time for one this term, do the checklist first — it produces work, and work reduces risk.

What actually goes in it

Six columns is enough, and more than six is usually a sign the document is being written for a filing cabinet rather than a meeting:

The risk, written as a sentence — not “ransomware” but “ransomware encrypts the file servers and the school cannot run the timetable for two weeks”. A one-word risk cannot be scored, argued with, or closed.
Likelihood and impact, on whatever scale you already use for every other risk in the school. Consistency with the rest of the register matters more than the scale itself.
What is already in place — the controls you can evidence today, not the ones you intend.
The owner: a named person. “IT” is not an owner. Neither is “SLT”.
What would reduce it further, with a date.
When it gets reviewed. A risk with no review date is a risk that will be reviewed after the incident.

The risks worth having on the register

Every school is different, and a register copied from another school is somebody else’s document. That said, the same handful come up in nearly every school we see, and their absence is usually an oversight rather than a decision:

Ransomware, and the restore nobody has tested

The risk is rarely the encryption. It is discovering, on the morning it matters, that the backup was also reachable from the network, or that nobody has performed a real restore in two years. Score the restore, not the backup.

A staff account taken over

Usually through a convincing email rather than anything sophisticated. The control that moves this risk most is multi-factor authentication actually enforced — not available, enforced — and the evidence is a setting somebody has looked at, not an assurance.

A supplier holding your data is breached

This one is routinely missing, and it is the one where schools get the law backwards: the school remains the data controller, and the 72-hour clock starts when the school is told. Your MIS, your cashless catering, your safeguarding system, your parental communications platform — each is a row.

Money moved on a forged instruction

An email that appears to come from the head or a known supplier, asking for bank details to be changed. It is the most common way UK schools lose money, and the control is a process rather than a product: verify by phone, on a number you already held.

The person who knows how it all works leaves

Rarely on a cyber register and frequently the biggest one. If one person holds the passwords, the supplier relationships and the knowledge of how the network is put together, that is a risk with a name on it.

Scoring, without pretending it is science

Most schools use a five-by-five grid — likelihood one to five, impact one to five, multiply them — because that is what the rest of the school’s risk register uses. There is no statutory scheme for cyber risk in schools, and anybody presenting one as required has invented it.

The score is not the point. The conversation the score forces is the point: two people disagreeing about whether an impact is a three or a five are having the discussion the document exists to produce.

Score the residual risk, and say so

A register that scores every risk as though no controls exist reads as alarmist and gets ignored. One that scores them as though every control works perfectly is worse. Score what is left after the controls you can actually evidence, and note which evidence you are relying on.

What governors do with it

They should see the same register each term, with movement shown rather than a fresh document. Three questions are worth more than a full read-through: which risks moved and why, which have an owner who has changed jobs, and which have a review date that has already passed. The governor question set goes further into what good answers sound like.

A trust adds one more: whether the register is the trust’s or each academy’s. Both is a defensible answer; neither, because everyone assumed the other held it, is the usual one.

Where an assessment tool helps, and where it does not

A readiness assessment tells you where you stand and which gaps matter most — it is the evidence you write the register from, and it is the part that is tedious to do by hand every term. Ours is free to run and needs no account.

What no tool does is own a risk. The names, the dates and the judgement about what your school could tolerate losing are the school’s, and a register produced entirely by software is one nobody in the room feels responsible for.