Schools should ensure that they have access controls in place:

• Mobile phones - can access the internet and so you must have a policy on phone use in school which covers staff, visitors and students
• Controlled access to files - both on the school network and files on the Cloud. Ensure that there is an audit trail of who accessed what information and from where
• Cloud storage - where a school is using low cost Cloud storage make sure that it is set up as a school storage area as major suppliers provide security appropriate for a school. DO NOT use personal cloud storage spaces

In November 2018, the DfE published draft non-statutory guidance on Cybersecurity & safeguarding for schools.