Zero Tolerance: Reading the DfE's Cyber Standard Update

The 60-second Briefing

• On June 24 2026, the DfE updated its Core Cyber Security Standard for schools and colleges to align with NCSC Cyber Essentials 2026, which replaces the previous Willow question set with a new one called Danzell.
• Two specific exemptions have been removed. Multi-Factor Authentication is now an automatic fail if available on cloud services but not enabled, with no cost exemption. Vulnerability patching within 14 days for high or critical CVSS scores now has zero tolerance rather than the previous "two near-misses" allowance.
• The DfE Standards sit inside a wider architecture aligned to the NCSC Cyber Assessment Framework, which was itself updated to CAF 4.0 in July 2026.
• CAF is outcomes-based, structured around 4 objectives, 14 principles, and 41 contributing outcomes. It is the framework used across UK critical national infrastructure.
• The US equivalent, the NIST Cybersecurity Framework 2.0, is structured around 6 functions (Govern, Identify, Protect, Detect, Respond, Recover) and takes a different approach. Understanding both frameworks matters more than aligning to only one.

October is Cyber Security Awareness Month, and the NCSC's theme for 2026 is Don't Make It Easy For Them. It is a line that could stand in for most of what IT governance teaches, and it is particularly apt for the UK schools sector right now. The direction of travel in the DfE's own standards is that it is no longer schools' job to decide how easy they want to make it.

Two updates happened in June and July that any school IT lead should have read but which have received almost no attention outside the specialist cyber press. On June 24, the DfE updated its Core Cyber Security Standard for schools and colleges. On July 30, the NCSC released version 4.0 of the Cyber Assessment Framework. Together, they represent the direction of travel for how schools will be expected to demonstrate cybersecurity posture over the next three to five years. Neither of them is glamorous. Both of them will shape procurement, capital planning, and inspection outcomes.

Let me walk through what the DfE update actually did, then step back and look at the wider framework question, because that is where the more interesting argument lives.

What the June 24 update changed

The DfE Core Cyber Security Standard update was described by the department as reflecting "new technical requirements introduced by the National Cyber Security Centre as part of the Cyber Essentials 2026 standard." That is a genuinely modest way of describing what the update actually does, which is remove two important exemptions that schools had been quietly relying on.

The first is Multi-Factor Authentication. Under the previous Willow question set, schools could claim a cost exemption on MFA in certain circumstances. Under the new Danzell question set, MFA is now an automatic fail if it is available on cloud services and not enabled. There is no cost exemption. The reasoning is straightforward. MFA is now included at no additional cost in every major cloud platform that schools use. If a school has not enabled it, the reason is not cost. The reason is that nobody has made the effort.

The second is vulnerability patching. Under Willow, schools could carry two "near misses" on the 14-day patching window for high or critical vulnerabilities and still pass. Under Danzell, that allowance is gone. The 14-day window on high or critical CVSS scores of 7.0 or above is now a zero-tolerance requirement. A single missed patch on a single high-severity CVE at a single site can now fail the standard.

For most schools, both changes are more operationally significant than they look. MFA has been on IT to-do lists for years, but the cost exemption was often used as cover for not actually finishing the rollout across every account, every service, every user. The tightening removes that cover. Vulnerability patching, similarly, has often been a headline-level compliance claim rather than a site-level operational reality. Multi-academy trusts with several sites will find that a policy working reliably at the flagship school is not enough. Every site has to be current, every month, on every high or critical patch.

The direction of travel is clear enough. The DfE is quietly moving the standard from "have a policy" to "demonstrate the policy is working at every site, every time." That is a much higher bar. It is also what the rest of the UK public sector has been operating under for several years.

The framework question

Which brings me to the more interesting question. What framework is the DfE actually aligning schools to, and how does it compare to the alternatives?

The DfE Cyber Security Standards sit inside a wider architecture. They align explicitly with NCSC Cyber Essentials, which is a technical controls certification scheme, and they reference NCSC guidance throughout. The NCSC Cyber Assessment Framework is where the wider UK cyber governance conversation is happening, and the direction of travel in school cyber policy, from policy-level compliance to demonstrated site-level compliance, reflects the same thinking. CAF was updated to version 4.0 in July 2026, and its new content on threat-informed risk management, secure software development, and AI-related cyber risks is where the strategic agenda for UK institutions is now being drawn.

CAF is structured around four objectives, 14 principles, and 41 contributing outcomes. The four objectives are: managing security risk, protecting against cyber attacks, detecting cybersecurity events, and minimising the impact of incidents. Each principle sits under one of the objectives. Each contributing outcome under each principle is assessed as Achieved, Partially Achieved, Not Achieved, or (where justified) Not Applicable.

The philosophy of CAF is outcomes-based. It does not tell you which specific tool to buy or which specific policy to write. It tells you what security outcome you need to demonstrate, and leaves you to work out how. That is either a strength or a weakness depending on your perspective. For a well-resourced organisation with mature security governance, it is a strength: it allows for proportionate, context-appropriate implementation. For a small school IT department without dedicated security expertise, it can be intimidating: without a checklist to work through, some IT leads do not know where to start.

Compare this to the NIST Cybersecurity Framework 2.0, which is the equivalent framework used by most US organisations and, increasingly, by multinational businesses operating in the UK. NIST CSF 2.0 is structured around six functions: Govern (added in 2024), Identify, Protect, Detect, Respond, and Recover. Under each function sit categories and subcategories, roughly analogous to CAF's principles and outcomes.

The philosophical differences between CAF and NIST CSF matter for how a school leader reads either framework.

CAF is UK-centric, outcomes-focused, and designed originally for critical national infrastructure. Its language is precise, its structure is hierarchical, and its assessment model is binary at the outcome level (achieved or not). It assumes an organisation with a security function capable of designing its own controls to meet the stated outcomes. It is the strategic framework shaping how UK cyber governance is being thought about more broadly, and the DfE Standards are moving in a direction that reflects it.

NIST CSF is US-origin, function-focused, and designed for a much broader range of organisations from small businesses to federal agencies. Its language is more accessible, its structure is more modular, and its assessment model uses profiles and tiers rather than binary outcomes. It assumes an organisation that may or may not have a security function and provides scaffolding for building one. It is the natural fit for organisations that need a common language across international operations or that are working with US suppliers.

For schools, the practical position is that the DfE Standards and Cyber Essentials are what the school will be measured against, CAF is the UK's strategic reference point, and NIST CSF is often what suppliers will use to describe their own security posture. Reading all three is useful. Trying to implement all three simultaneously is not.

What this means for school IT leads

Three practical actions worth taking this term.

The first is the operational one. If MFA is not enabled on every cloud service the school uses, for every user, that is now the priority. The cost exemption is gone. The audit trail matters. Any account or service that could support MFA and does not is now a fail against the DfE standard.

The second is the patching one. If patching is currently a policy claim rather than a demonstrated site-level reality across every school in the trust or every server on the network, that gap needs closing. The zero-tolerance model means one missed patch on one server can fail the standard. The audit trail, again, matters. A school that can show which patches were applied, when, and by whom will be in a much stronger position than one that cannot.

The third is the framework literacy one. If the IT lead has not read CAF 4.0 recently, this is the term to do it. Not because the school will be assessed against it directly, but because the DfE Cyber Security Standards will keep evolving in the direction CAF sets, and understanding the underlying framework makes the standards much easier to interpret. If the IT lead has never looked at NIST CSF 2.0, an afternoon comparing the two frameworks is time well spent. Not to implement both, but to understand which one a supplier is speaking when a supplier claims to be "framework-aligned."

A wider point

This blog has been arguing all year that cyber risk is an institutional governance matter rather than a technical one. The DfE update is a quiet confirmation of that position from the department itself. Removing exemptions and shortening tolerances are not technical changes. They are governance decisions. They say that a school's cyber posture is not something the IT department can be trusted to describe in its own words. It has to be demonstrable at site level, in real time, against a defined standard that is itself defined by a framework operating well above the DfE.

The move from Willow to Danzell is one small step in a much longer arc. The move from Willow-era policy-level compliance to Danzell-era demonstrated site-level compliance is a genuine tightening. And the strategic cyber thinking that CAF 4.0 now sets out is the direction school cyber policy will keep moving in through 2028, 2029, and beyond.

Read the update. Read CAF 4.0. Read NIST CSF 2.0 for context. Then look at your own school's actual posture against all three and be honest about the gaps.

'Don't Make It Easy For Them' is the awareness-month message directed at pupils and staff. The DfE has quietly applied the same message to schools themselves.

The exemptions have gone. The framework is tightening. The question is not whether your school will be measured against it. The question is when.

See you in the digital staffroom.