iFairy working template · Checklist
Filtering, monitoring and cyber security review record
A termly and annual review record against the DfE filtering and monitoring standards and the cyber security standards, with the online safety duties from Keeping Children Safe in Education. For each standard: who is responsible, how it is met, the evidence, and the gaps.
iFairy working template — not official guidance. Built by reading the official documents listed under "Based on"; each requirement cites the document and section it comes from. Check the current official wording before you adopt it, and adapt it to your setting and your local authority or trust procedures.
| Do you need one? | Making sure appropriate filtering and monitoring is in place and regularly reviewed is a duty on governing bodies and proprietors in KCSIE, which is statutory guidance. The filtering and monitoring standards are DfE standards schools 'should already be meeting'; implementing IWF and CTIRU blocklists is a 'must'. The cyber security standards are non-statutory DfE standards (schools are working towards them by 2030), though some items are conditions of RPA cover. This record format itself is good practice. |
|---|---|
| Why this template | KCSIE tells governors to make sure appropriate filtering and monitoring is in place and reviewed, and points to two sets of DfE digital standards that run to many pages. Schools are asked to record their annual review and keep a log of checks, but no form is provided. This record puts every requirement in one place so the DSL, a senior leader, IT support and the responsible governor can complete and sign it together. |
| Review | Full review at least once every academic year, and after a trigger event (new safeguarding risk, new devices, BYOD or remote access, major updates, network changes). Filtering checks and cyber items reviewed termly. |
| Last checked by iFairy |
1. Review details and named roles
Record who is responsible. The first filtering and monitoring standard is that roles and responsibilities are identified and assigned, including a senior leader and a governor.
Must include
- Governing bodies and proprietors should assign a member of the senior leadership team and a governor to be responsible for ensuring the standards are met, and set out the roles of staff and third parties such as IT support.Source: Filtering and monitoring core standard, Identify and assign roles and responsibilities — How to meet the standard
- It must be clear who is responsible, and it must be possible to make prompt changes to your provision.
“it must be clear who is responsible and it must be possible to make prompt changes to your provision.”
Source: Filtering and monitoring core standard, Identify and assign roles and responsibilities — How to meet the standard - The DSL takes lead responsibility for safeguarding and child protection, including online safety and understanding the filtering and monitoring systems and processes in place; this should be explicit in the job description.Source: Keeping Children Safe in Education 2025, Part two, para 102
- The SLT is responsible for buying systems, documenting what is blocked or allowed and why, reviewing effectiveness and overseeing reports; IT support maintains systems, provides reports and completes actions.Source: Filtering and monitoring core standard, Identify and assign roles and responsibilities — Technical requirements
Decide and write down
- Is IT support in-house, trust-provided or a third-party contract? Does the contract cover the checks and reports listed below?
- Who is the SLT digital lead for the cyber standards — the same person as the filtering and monitoring lead, or different?
Starter wording (edit the highlighted parts)
School: [name] Review type: [annual / termly / triggered by: ...] Date: [date]
| Role | Name | Responsibility |
|---|---|---|
| SLT lead for filtering and monitoring | [name] | Procurement, documenting block/allow decisions, reviewing effectiveness, overseeing reports, staff training |
| Responsible governor | [name] | Strategic assurance that the standards are met |
| Designated safeguarding lead | [name] | Checks reports, responds to concerns, assures governors |
| IT support | [name / company, contract ref] | Maintains systems, provides reports, completes actions after checks |
| SLT digital lead (cyber) | [name] | Cyber risk assessment, training, backup plan, incident reporting |
| Data protection officer | [name] | DPIAs, data breach advice |
2. Annual filtering and monitoring review
Review provision at least once every academic year and record the results. The standard lists what the review should consider and what it should inform.
Must include
- Review filtering and monitoring at least once every academic year; it can be part of a wider online safety review. It should be carried out by SLT, the DSL and IT support, and involve the responsible governor.Source: Filtering and monitoring core standard, Review your filtering and monitoring provision at least annually — How to meet the standard
- Record the results of the review and make them available to anyone entitled to inspect that information.Source: Filtering and monitoring core standard, Review your filtering and monitoring provision at least annually — How to meet the standard
- The review should consider pupils' risk profile (age, SEND, EAL), what is blocked or allowed, technical limitations, outside safeguarding influences such as county lines, relevant incidents, digital resilience, RSHE/PSHE teaching needs, how technology is used (including BYOD and generative AI), related policies, and current checks.Source: Filtering and monitoring core standard, Review your filtering and monitoring provision at least annually — Technical requirements
- Review again outside the annual cycle when a safeguarding risk is identified, working practice changes (remote access, BYOD), new technology or devices are introduced, major software updates occur, or the network configuration changes.Source: Filtering and monitoring core standard, Review your filtering and monitoring provision at least annually — Technical requirements
- Governors should consider the number and age range of children, those at greater risk of harm, how often they use the IT system, and proportionality of cost against safeguarding risk.Source: Keeping Children Safe in Education 2025, Part two, para 140
- The appropriateness of filtering and monitoring is a matter for each school, informed in part by the Prevent duty risk assessment.Source: Keeping Children Safe in Education 2025, Part two, para 141
Decide and write down
- What does your Prevent risk assessment say about online risk, and does the filtering configuration reflect it?
- Which groups of pupils are at greater risk (e.g. SEND, looked-after children, pupils with recent online incidents), and is anything different for them?
- Are generative AI tools in use by staff or pupils, and are they covered by filtering and monitoring?
Starter wording (edit the highlighted parts)
| Review question | Current position | Evidence | Gap / action |
|---|---|---|---|
| Pupil risk profile (age, SEND, EAL, known risks) | [ ] | [ ] | [ ] |
| What the filter blocks and allows; block/allow decisions documented | [ ] | [decision log ref] | [ ] |
| Technical limitations (e.g. real-time content, apps) | [ ] | [ ] | [ ] |
| Local safeguarding influences and recent incidents | [ ] | [DSL summary] | [ ] |
| Curriculum needs (RSHE, PSHE, computing) — over-blocking? | [ ] | [staff feedback] | [ ] |
| Use of technology: BYOD, remote access, generative AI | [ ] | [ ] | [ ] |
| Related policies up to date (child protection, AUP, mobile and smart technology) | [ ] | [ ] | [ ] |
| Checks carried out this year and actions taken | [ ] | [check log] | [ ] |
3. Filtering and monitoring checks log
Keep a log of checks so they can be reviewed. Frequency is for the school to set based on its risks; termly is a sensible minimum.
Must include
- Checks should confirm the setup has not changed or been deactivated, covering school-owned devices (including those taken home), all sites, and that student, staff and guest groups are filtered correctly.Source: Filtering and monitoring core standard, Review your filtering and monitoring provision at least annually — Technical requirements (checks)
- Log when the check took place, who did it, what was tested, and resulting actions.Source: Filtering and monitoring core standard, Review your filtering and monitoring provision at least annually — Technical requirements (checks)
- Make sure filtering and monitoring work on new devices and services before they are given out.Source: Filtering and monitoring core standard, Review your filtering and monitoring provision at least annually — Technical requirements (checks)
Decide and write down
- How often will you check, given your risk profile — and who does it from the safeguarding side as well as the IT side?
Starter wording (edit the highlighted parts)
| Date | Checked by (DSL / IT) | Device, site or user group | What was tested | Result | Action and owner |
|---|---|---|---|---|---|
| [date] | [names] | [e.g. year 7 pupil account, library laptop, guest Wi-Fi] | [e.g. SWGfL test; attempted access to blocked category] | [pass / fail] | [ ] |
4. Filtering: blocks harmful content without unreasonably affecting teaching
Record how the filtering system meets the technical requirements, and where it falls short.
Must include
- Schools must make sure the IWF and CTIRU blocklists are implemented, and that they cannot be disabled, overridden or altered by any user at any level.Source: Filtering and monitoring core standard, Filtering systems should block harmful and inappropriate content — Technical requirements
- No blanket profile for all users: as a minimum, separate student and staff profiles.Source: Filtering and monitoring core standard, Filtering systems should block harmful and inappropriate content — How to meet the standard
- Filtering should be active and applied to school-managed devices (including off-site), BYOD devices and guests; unmanaged devices should be on a separate virtual network.Source: Filtering and monitoring core standard, Filtering systems should block harmful and inappropriate content — Technical requirements
- Filtering should identify, as a minimum, device name or ID and IP address (and where possible the individual), time and date of attempted access, and the search term or content blocked.Source: Filtering and monitoring core standard, Filtering systems should block harmful and inappropriate content — Technical requirements
- Safe search should be on by default and locked into the browser; users should not be able to install other browsers or unauthorised plugins. Techniques to bypass filtering such as VPNs and proxies should be blocked.Source: Filtering and monitoring core standard, Filtering systems should block harmful and inappropriate content — Technical requirements
- Governors should take care that over-blocking does not lead to unreasonable restrictions on what children can be taught about online safety.Source: Keeping Children Safe in Education 2025, Part two, para 133
Starter wording (edit the highlighted parts)
| Requirement | Met? (Y / partly / N) | How it is met | Evidence | Gap |
|---|---|---|---|---|
| Provider is an IWF member, signed up to CTIRU, updates blocklists | [ ] | [provider name] | [provider statement / SWGfL test] | [ ] |
| Blocklists cannot be overridden by anyone | [ ] | [ ] | [ ] | [ ] |
| Separate pupil and staff (and guest) profiles | [ ] | [ ] | [ ] | [ ] |
| Applies off-site, to BYOD and guests; unmanaged devices on separate network | [ ] | [ ] | [ ] | [ ] |
| All internet feeds covered, incl. backup connections and portable Wi-Fi | [ ] | [ ] | [ ] | [ ] |
| Blocks VPNs, proxies and bypass techniques | [ ] | [ ] | [ ] | [ ] |
| Multilingual content, images, misspellings and abbreviations | [ ] | [ ] | [ ] | [ ] |
| Alerts when content of concern is blocked | [ ] | [ ] | [ ] | [ ] |
| Logs device/IP/user, time and date, search term | [ ] | [ ] | [ ] | [ ] |
| Safe search locked; no extra browsers or plugins | [ ] | [ ] | [ ] | [ ] |
| Mobile and app content: filtered, or technical monitoring applied | [ ] | [ ] | [ ] | [ ] |
| DPIA completed and provider privacy notice reviewed | [ ] | [ ] | [ ] | [ ] |
| Staff know how to report over- or under-blocking | [ ] | [ ] | [ ] | [ ] |
5. Monitoring strategy
Record how pupils' activity on school devices is monitored and how incidents are picked up and acted on.
Must include
- All staff in a room with pupils on devices should carry out in-person monitoring as part of classroom supervision; the DSL is responsible for safeguarding matters identified through monitoring.Source: Filtering and monitoring core standard, Have effective monitoring strategies — How to meet the standard
- As a minimum, the monitoring plan should include weekly reports highlighting incidents and immediate reports for high-risk incidents.Source: Filtering and monitoring core standard, Have effective monitoring strategies — Technical requirements
- Everyone using the network should know filtering and monitoring are in place; technical monitoring should notify users that the device is monitored.Source: Filtering and monitoring core standard, Have effective monitoring strategies — Technical requirements
- There should be a documented process for recording incidents, the action taken and outcomes; monitoring procedures should be reflected in the acceptable use policy and privacy notices.Source: Filtering and monitoring core standard, Have effective monitoring strategies — Technical requirements
- Monitoring should identify and alert to behaviours associated with the four areas of risk in KCSIE: content, contact, conduct and commerce.Source: Keeping Children Safe in Education 2025, Part two, para 135
Decide and write down
- Do you use technical monitoring (device or network), or rely on in-person supervision? What in your risk profile justifies that?
- Who receives the weekly report and the immediate alerts, including in holidays?
- Can every alert be traced to an individual, including guest and shared accounts?
Starter wording (edit the highlighted parts)
Monitoring approach: [in-person only / device monitoring software: [product] / network log monitoring].
Weekly incident report received by [DSL name] on [day]. High-risk alerts go immediately to [names, contact route], including out of hours by [method].
Users are told about monitoring by [login banner / AUP / privacy notice]. Incidents are recorded in [CPOMS / MyConcern / other] with action and outcome.
| Requirement | Met? | Evidence | Gap |
|---|---|---|---|
| Weekly report and immediate high-risk alerts | [ ] | [ ] | [ ] |
| Works on-site and off-site | [ ] | [ ] | [ ] |
| Users notified | [ ] | [ ] | [ ] |
| Incident recording process | [ ] | [ ] | [ ] |
| IT support trained in safeguarding and reports to DSL | [ ] | [ ] | [ ] |
| DPIA for technical monitoring | [ ] | [ ] | [ ] |
6. Online safety policy, training and teaching
Technical controls only work alongside policy, staff training and teaching. Check these links are in place.
Must include
- Online safety and the school's approach to it should be reflected in the child protection policy, including appropriate filtering and monitoring on school devices and networks; the school should have a clear policy on mobile and smart technology.Source: Keeping Children Safe in Education 2025, Part two, para 137
- All staff should receive safeguarding training at induction including online safety, which covers expectations, roles and responsibilities for filtering and monitoring; it should be regularly updated.Source: Keeping Children Safe in Education 2025, Part two, para 123
- Parents and carers are likely to find it helpful to understand what systems the school uses to filter and monitor online use.Source: Keeping Children Safe in Education 2025, Part two, para 139
- Schools should consider an annual review of their approach to online safety, supported by an annual risk assessment of the risks their children face.Source: Keeping Children Safe in Education 2025, Part two, para 145
- DfE guidance supports schools to teach pupils how to stay safe and behave online as part of existing curriculum requirements.Source: Teaching online safety in schools, Details
Starter wording (edit the highlighted parts)
| Item | Date / version | Evidence | Gap |
|---|---|---|---|
| Child protection policy covers online safety and filtering and monitoring | [ ] | [ ] | [ ] |
| Mobile and smart technology policy | [ ] | [ ] | [ ] |
| Acceptable use policies (staff, pupil, visitor) reflect monitoring | [ ] | [ ] | [ ] |
| Staff induction and update training covers filtering and monitoring roles | [ ] | [training record] | [ ] |
| Online safety taught through RSHE, PSHE, computing; teachers can report over-blocking | [ ] | [curriculum map] | [ ] |
| Parents told what systems are used | [ ] | [website / letter] | [ ] |
7. Cyber security standards
Record progress against the cyber security standards, which protect the systems that filtering, monitoring and safeguarding records depend on.
Must include
- Schools should consider taking appropriate action to meet the Cyber security standards for schools and colleges, and review their security procedures periodically.Source: Keeping Children Safe in Education 2025, Part two, para 144
- Complete a cyber risk assessment every year (or after a significant change or incident) and revisit it every term; capture cyber risks in the risk register and have a cyber response plan.Source: Cyber security standards for schools, Conduct a cyber risk assessment annually and review every term
- Cyber training at least annually for pupils, staff, at least one governor or trustee, and anyone else with a login. RPA members must evidence annual NCSC training.Source: Cyber security standards for schools, Create and implement a cyber awareness plan — Train students and staff
- Check firewall firmware termly and document and review permitted inbound traffic at least termly, signed off by the SLT digital lead; keep anti-malware centrally managed and reviewed termly; block USB storage by default.Source: Cyber security standards for schools, Secure digital technology and data with anti-malware and a firewall — Technical requirements
- Senior leaders and staff working with confidential, financial or personal data must use multi-factor authentication; accounts should be reviewed every term and disabled as soon as someone leaves.Source: Cyber security standards for schools, Control and secure user accounts and access privileges
- Apply vulnerability fixes within 14 days of release where the CVSS score is 7.0 or above or no severity is given; review the contracts register each term for unsupported technology.Source: Cyber security standards for schools, License digital technology and keep it up to date
- Keep at least 3 backup copies on at least 2 separate devices, one off-site, immutable; test and log restores termly; review the backup plan annually.Source: Cyber security standards for schools, Develop and implement a plan to back up your data and review this every year
- Report incidents to Report Fraud and the DfE sector cyber team; to the ICO within 72 hours where a high-risk data breach may have occurred; and to the governing body. Record incidents and near misses.Source: Cyber security standards for schools, Report cyber attacks
Starter wording (edit the highlighted parts)
| Standard | Frequency | Owner | Last done | Evidence | Gap / action |
|---|---|---|---|---|---|
| Cyber risk assessment and response plan | Annual; revisit termly | [SLT digital lead] | [ ] | [risk register ref] | [ ] |
| Cyber awareness training (pupils, staff, governor) | Annual | [ ] | [ ] | [NCSC certificates] | [ ] |
| Firewall firmware and inbound rules | Termly | [IT support] | [ ] | [ ] | [ ] |
| Anti-malware review; USB policy | Termly | [IT support] | [ ] | [ ] | [ ] |
| MFA for staff with sensitive data; account review | Termly | [ ] | [ ] | [ ] | [ ] |
| Licensing and unsupported technology; 14-day patching | Termly | [ ] | [ ] | [ ] | [ ] |
| Backups: 3-2-1, immutable, restore tested | Termly test; annual plan review | [ ] | [ ] | [restore log] | [ ] |
| Incident reporting route known; incident log | Ongoing | [ ] | [ ] | [ ] | [ ] |
8. Gaps, action plan and sign-off
Turn gaps into dated actions and give the governing body assurance. The DSL should give governors assurance that systems work and are reviewed.
Must include
- The DSL should provide governors with assurance that filtering and monitoring systems are working effectively and reviewed regularly.Source: Filtering and monitoring core standard, Identify and assign roles and responsibilities — Technical requirements
- Governing bodies should review the standards and discuss with IT staff and service providers what more needs to be done.Source: Keeping Children Safe in Education 2025, Part two, para 143
Starter wording (edit the highlighted parts)
| Gap | Risk (H/M/L) | Action | Owner | Due | Done |
|---|---|---|---|---|---|
| [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
Signed: DSL [name, date] SLT lead [name, date] IT support [name, date] Responsible governor [name, date]
Reported to [full governing body / committee] on [date]. Next annual review due: [date]. Next termly check: [date].
Checklist
- Named SLT lead and governor for filtering and monitoring recorded and known to staff. (Filtering and monitoring core standard, Identify and assign roles and responsibilities)
- Annual review completed by SLT, DSL and IT support with the governor, and results recorded. (Filtering and monitoring core standard, Review your filtering and monitoring provision at least annually)
- SWGfL test run and logged; IWF/CTIRU membership of filtering provider confirmed in writing. (Filtering and monitoring core standard, Review your filtering and monitoring provision at least annually — Technical requirements (checks))
- Weekly monitoring report arriving and read; high-risk alert route tested. (Filtering and monitoring core standard, Have effective monitoring strategies — Technical requirements)
- DSL job description names online safety and filtering and monitoring. (Keeping Children Safe in Education 2025, Part two, para 102)
- Staff induction covers filtering and monitoring roles and how to report concerns. (Keeping Children Safe in Education 2025, Part two, para 123)
- Backup restore tested this term and logged. (Cyber security standards for schools, Develop and implement a plan to back up your data and review this every year)
- Cyber incident reporting contacts (Report Fraud, DfE sector cyber team, ICO, RPA/insurer) in the business continuity plan. (Cyber security standards for schools, Report cyber attacks)
- Optionally, self-assess using DfE's 'plan technology for your school' service and file the result with this record. (Keeping Children Safe in Education 2025, Part two, para 142)
Watch out
- KCSIE is revised most years and a new edition normally applies from 1 September. This template cites KCSIE 2025; by October 2026 a later edition may be in force with different paragraph numbers. Check the current version on GOV.UK and update the references.
- The filtering and monitoring and cyber security standards read for this template were updated on 17 April 2026. They are web pages that change without a new title — check GOV.UK for the current wording before each annual review.
- The filtering and monitoring standards say you should already be meeting them now. The 2030 date applies to meeting all 6 core digital standards, not to filtering and monitoring.
- Cyber Essentials is a funding requirement for colleges, not for schools. RPA members have extra conditions (annual NCSC training, backups, a cyber response plan) — check your RPA terms.
- Over-blocking is a risk too: KCSIE warns it can unreasonably restrict what children are taught about online safety. Record teachers' reports of blocked teaching content.
- Mobile phone networks (3G/4G/5G) bypass school filtering entirely; your mobile and smart technology policy has to cover this.
- A DPIA is needed for filtering and for technical monitoring; check one exists and is current when you change provider.
Based on these official documents
Main source
Filtering and monitoring core standard
The four filtering and monitoring standards: roles, annual review content and triggers, filtering checks and log, blocking requirements, and monitoring strategy. Version read: updated 17 April 2026.
Main source
Cyber security standards for schools
Cyber risk assessment, awareness training, firewall and anti-malware, accounts and MFA, licensing and patching, backups, and incident reporting. Version read: updated 17 April 2026.
Main source
Keeping Children Safe in Education 2025
Governors' duties on filtering and monitoring (paras 140–143), online safety and the 4Cs (paras 134–137), over-blocking (para 133), DSL role (para 102), staff training (para 123), information security (para 144) and annual online safety review (para 145).
Supporting source
Teaching online safety in schools
Link between technical controls and teaching pupils to stay safe online within existing subjects. The catalogue copy is the GOV.UK landing page (last updated 12 January 2023).