A safeguarding failure can begin with something that appears routine: a shared password, an unpatched classroom device, a pupil using mobile data to bypass filtering, or an urgent concern sitting unseen in an inbox. Technology cannot replace professional curiosity, trained staff or clear safeguarding procedures. It should, however, help schools spot risks earlier, protect sensitive information and respond without delay.
This school safeguarding technology checklist is designed for headteachers, designated safeguarding leads, business managers and trust leaders who need assurance that their digital environment supports, rather than weakens, their safeguarding responsibilities. It works best as a conversation between safeguarding, IT, data protection and senior leadership – not as a one-off technical exercise.
Start with ownership, not software
The most effective safeguarding technology arrangements have named owners. IT teams can configure systems and investigate alerts, but they should not be left to decide what constitutes a safeguarding concern. Equally, safeguarding teams need enough visibility to understand the limits of the technology they rely on.
Confirm that the school has a documented filtering and monitoring approach, reviewed by senior leaders and governors or trustees. It should set out which systems are in scope, who reviews reports, what happens when an alert is raised and how decisions are recorded. This should align with the school’s wider safeguarding policy, acceptable-use agreements and staff training.
There is no single setting that makes a school compliant or safe. A primary school with managed devices and a tightly controlled internet connection faces different risks from a sixth form with bring-your-own devices, remote study and broader research needs. The appropriate level of restriction depends on age range, curriculum, pupil needs and the potential for harm.
School safeguarding technology checklist: core controls
Work through the following areas and record both the current position and the action owner. Where a control is supplied by a third party, confirm who is responsible for reviewing it in practice.
1. Identity, passwords and access
An account is a route into school systems, not simply a login. Former staff, leavers and temporary users with unnecessary access create avoidable risk, particularly where records, email and safeguarding information are held in cloud services.
- Multi-factor authentication is enabled for staff, governors and any account with access to sensitive systems, especially remote access and Microsoft 365.
- Staff, pupil and visitor accounts are created, amended and removed through a controlled process tied to starters, movers and leavers.
- Shared administrator accounts are eliminated wherever possible, and privileged access is limited to those who genuinely need it.
- Password standards are proportionate, supported by a password manager where appropriate, and never lead staff to write credentials down or share them.
Review access to safeguarding platforms separately. The principle should be clear: people can see the information required for their role, and no more. This protects children and protects staff from accessing information that they do not need to handle.
2. Filtering and monitoring that people understand
Filtering blocks or restricts access to unsuitable content. Monitoring identifies concerning activity or patterns that may need human review. They are related, but they are not the same control, and schools need both.
Check that filtering categories are appropriate for pupils, staff and guests, and that reasonable exceptions are managed through an approval process. Overly broad blocking can frustrate legitimate learning and encourage workarounds. Under-filtering can expose pupils to harmful material. Testing should include the devices and networks pupils actually use, not only a staff desktop on the wired network.
Monitoring needs a clear route from alert to action. Ask who receives alerts, how often they are reviewed, what happens outside school hours, and when an IT issue becomes a safeguarding referral. A large volume of unexplained alerts is not reassurance. It often means the system is generating noise that nobody can interpret confidently.
Monitoring should be transparent and proportionate. Pupils, staff and parents should understand the school’s acceptable-use expectations and, where relevant, how online activity may be reviewed. Schools must balance safety with privacy, data protection and a culture of trust.
3. Managed devices and secure networks
A device used by a pupil may hold saved passwords, browsing history, schoolwork, photographs or access to learning platforms. Devices should be managed as part of safeguarding, whether they are owned by the school or permitted under a bring-your-own-device policy.
Verify that operating systems, browsers and applications receive security updates promptly. Use central device management to apply security settings, encrypt portable devices, control app installation and remotely remove school data where appropriate. Antivirus or endpoint protection should be centrally monitored rather than installed and forgotten.
Separate pupil, staff, guest and operational networks. This reduces the chance that an unmanaged visitor device can reach sensitive systems or that an infected device can move freely across the estate. Wi-Fi should have suitable authentication, and the network should be reviewed when buildings, providers or device numbers change.
4. Safe communication and reporting routes
A pupil who is worried about online harm needs a route to report it that is known, accessible and taken seriously. Technology can support this through approved email, reporting forms or safeguarding platforms, but the route must lead to a person who can respond.
Review the channels staff use to communicate with pupils and parents. Personal messaging apps, unmanaged group chats and informal social media accounts can make records difficult to retain and boundaries difficult to maintain. Approved channels should have clear rules for use, retention and escalation.
Safeguarding case-management systems should have controlled access, audit trails and an agreed approach to recording information. A good record is factual, timely and accessible to authorised colleagues when needed. It is not a reason to duplicate sensitive information across email inboxes, spreadsheets and personal notebooks.
5. Data protection, backups and recovery
Safeguarding records are among the most sensitive information a school holds. Losing access to them during a cyber incident can be as damaging as an unauthorised disclosure. Recovery planning is therefore part of safeguarding readiness.
Check that critical data is backed up automatically, protected from alteration by ransomware and tested through actual restoration exercises. A backup that has never been restored is an assumption, not a recovery plan. Identify the systems the school would need first if it lost access to its network, including MIS data, safeguarding records, communications and identity services.
Have an agreed cyber incident process that includes the safeguarding lead, senior leadership and data protection responsibilities. Staff should know how to report a suspected phishing email, lost device or unusual account activity quickly. Speed matters, but so does calm coordination: indiscriminate changes can destroy evidence or interrupt essential school operations.
6. Physical security and connected systems
Safeguarding technology extends beyond screens. CCTV, access control, visitor management, door-entry systems and emergency communications can all support a safer site, provided they are maintained and used appropriately.
Confirm that CCTV coverage, retention periods and viewing permissions are documented. Check that access control permissions are removed for leavers, contractor access is time-limited and emergency override processes are understood. Connected physical security systems should be patched and placed on suitable networks, rather than treated as standalone appliances.
Turn the checklist into an ongoing review
A checklist has value only when it produces action. Prioritise weaknesses by likely impact and urgency. An exposed administrator account or no viable backup recovery plan needs prompt attention; a planned review of visitor Wi-Fi may be scheduled, but should still have an owner and deadline.
For Multi-Academy Trusts, establish a consistent minimum standard while allowing schools to address local needs. Central visibility of account security, device compliance, backup status and critical alerts can reduce gaps between sites. It should not remove the local knowledge that enables a safeguarding concern to be understood in context.
Review the technology arrangements at least annually, and after a serious incident, major system change or significant change to the school community. Include safeguarding leads in supplier reviews and ask providers direct questions about alert handling, data location, support escalation and recovery commitments.
The right safeguarding technology is rarely the most complicated product. It is the set of controls your people understand, review and can rely on when a concern needs an immediate, accountable response.
