In short: Appropriate filtering for schools means blocking illegal and harmful online content without unreasonably restricting teaching. In 2026 it is shaped by KCSIE 2026, the DfE's four filtering and monitoring standards and the UK Safer Internet Centre's May 2026 definition. Schools must assign roles, review annually, block harmful content and monitor effectively.
Where the requirement comes from
Keeping Children Safe in Education (KCSIE) 2026, in force from 1 September 2026, is statutory guidance that expects schools and colleges in England to have appropriate filtering and monitoring systems and to review them. KCSIE does not define a product; it points schools to two more detailed sources:
- the DfE's Filtering and monitoring standards for schools and colleges on gov.uk, last updated 16 September 2026, which say what good looks like and who is responsible
- the UK Safer Internet Centre's Appropriate Filtering for Education settings definition, updated in May 2026, which sets out what a filtering system should block and which features it should have
Filtering and monitoring are separate duties. Filtering is preventative: it stops access to content. Monitoring is reactive: it reviews what users do and raises concerns. A school needs both, and they are often different products.
The four DfE standards
The DfE standards are short, but each one has practical consequences:
| Standard | What it asks | Who is involved |
|---|---|---|
| 1. Identify and assign roles and responsibilities | Name a senior leader and a governor responsible; make sure changes to provision can be made promptly | Governors, senior leaders, DSL, IT support |
| 2. Review provision at least annually | Review at least once every academic year and record the date, who checked, what was tested and the actions taken; review again when a safeguarding risk is identified or after changes such as remote access, BYOD, generative AI tools, major software updates or network changes | Senior leaders, DSL, IT support, governor |
| 3. Block harmful and inappropriate content without unreasonably impacting teaching and learning | Test the filter, for example with SWGfL's testing tool; use at least separate staff and student profiles rather than one blanket setting; implement IWF and CTIRU blocklists that nobody, including administrators, can disable; filter managed devices on and off site, BYOD and guests, with unmanaged devices on a separate virtual network; lock safe search on; log the device, IP address, user where possible, time and the search term or content blocked; have the responsible senior leader approve and document exceptions | Senior leaders, DSL, IT support |
| 4. Have effective monitoring strategies | Combine supervision, device or network monitoring as appropriate; weekly reporting, with immediate reports for high-risk incidents; tell users monitoring is in place | DSL, senior leaders, IT support |
The standards also tell schools to confirm that their filtering provider is a member of the Internet Watch Foundation and signed up to the Counter-Terrorism Internet Referral Unit (CTIRU) list, and that it regularly updates blocklists using information from both. Ask for that in writing.
The current standards also ask schools to think about AI-generated content, which increasingly appears inside apps and browsers. The annual review should consider whether your filtering can handle real-time, dynamic and AI-generated content, and any generative AI product should be checked against the DfE's generative AI product safety standards before it is introduced.
What the UK Safer Internet Centre definition covers
The UKSIC definition describes what an appropriate filter should handle in three parts.
Illegal content, framed around the Online Safety Act, including child sexual abuse material, terrorism, extreme pornography, fraud, intimate image abuse, promoting suicide, and the sale of illegal drugs or weapons.
Inappropriate content, where schools set their own approach: gambling, hate speech and discrimination, harmful content, malware and hacking, mis- and disinformation, piracy and copyright theft, pornography, self-harm and eating disorders, and violence against women and girls.
System features, including:
- differentiated filtering by age, vulnerability and risk, with different strength for staff
- handling circumvention such as VPNs, proxies, DNS over HTTPS and Encrypted Client Hello
- control and audit of changes, plus historical reports and a way for users to report problems
- real-time content filtering that judges content by meaning and context, not only by category or domain list
- identification of users and devices, filtering of remote devices, and mobile and app content
- multi-site management, multiple-language support, SafeSearch and links to safeguarding case management
The definition also expects providers to publish a filtering policy rationale, be clear about how they avoid over-blocking, describe how their system is deployed and its limitations, and be transparent about how encrypted traffic is handled. It notes that relying solely on network-level filtering may become less effective, and suggests combining it with device-level configuration on school-owned devices. Schools, as data controllers, should understand each provider's log retention. Separately, the UK Safer Internet Centre runs an accreditation scheme for filtering systems and publishes self-certified provider responses, so check its site for the current status of any provider you are considering.
Wales, Scotland and over-blocking
Expectations differ across the UK. In Wales, the Welsh Government has published a common set of agreed standards for internet access in schools through Hwb, which helps schools make informed choices about filtering. In Scotland, schools are expected to have IT policies and to use filtering to restrict access to harmful content.
Over-blocking gets as much attention as under-blocking. The DfE and UKSIC both warn that blocking too much can unreasonably restrict what pupils are taught: sex education, health, history and current affairs are common casualties. A good filtering policy records why each category is blocked, gives staff a quick route to request a review, and is checked against real lessons. Logs should be kept only as long as you need them, and a data protection impact assessment (DPIA) is sensible for any system that records pupils' activity.
Questions to ask any filtering provider
Use these questions with any provider, including us. Ask for answers in writing and keep them with your annual review:
- Are you a member of the Internet Watch Foundation, and how is the IWF list applied? Can anyone, including our administrators, switch it off?
- Is the CTIRU list implemented, and how often is it updated?
- Have you published a response to the UK Safer Internet Centre's appropriate filtering definition, and is your system accredited under its scheme?
- Can your system record the search term or content blocked, as the DfE standards expect, and analyse content in real time?
- Which devices are filtered on site, off site, on guest Wi-Fi and on BYOD, and what happens on mobile data?
- How do you handle VPNs, proxies, DNS over HTTPS and Encrypted Client Hello?
- Can we set different policies for staff, students and year groups, using our existing directory?
- What do the logs record (device, user, time, search term, page), how long are they kept and where are they stored?
- How are exceptions requested, approved and audited?
- What monitoring, if any, is included, and if none, what do you recommend alongside your filter?
- What is the product's lifecycle: is it still on sale, and when does support end?
Where DNS filtering helps, and where schools need more
DNS filtering, which is what Cisco Umbrella for schools provides on every package, is a strong base layer. It filters every device that uses the school's DNS, follows managed laptops and Chromebooks home, blocks known threats, enforces SafeSearch and applies different policies by group.
It is not the whole answer. DNS sees domains, not pages or search terms, so page-level decisions, search-term logging and real-time content analysis need a proxy, such as the intelligent proxy or a secure web gateway, or another product. Pupils can sometimes bypass DNS with encrypted DNS or VPNs, so circumvention categories need to be blocked and devices managed. And DNS filtering provides no monitoring, so a separate monitoring approach is needed to meet the fourth DfE standard. The Umbrella content categories guide explains the categories that matter for this.
Forever Systems helps schools, colleges and trusts review their current filtering against the DfE standards and UKSIC definition, document the rationale and exceptions, and plan changes. Contact us to arrange a review.
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is appropriate filtering in schools?
Appropriate filtering means blocking illegal and harmful online content, and other content the school judges inappropriate, without unreasonably restricting teaching and learning. The DfE's filtering and monitoring standards and the UK Safer Internet Centre's definition set out the detail.
How often should a school review its filtering and monitoring?
At least once every academic year, under the DfE standards, and again when a safeguarding risk is identified or something significant changes, such as remote access, BYOD, new generative AI tools, major software updates or network changes. Record the date, who carried out the checks, what was tested and the actions taken.
What is the difference between filtering and monitoring?
Filtering is preventative: it stops users reaching content. Monitoring is reactive: it reviews what users do and alerts staff to concerns. The DfE expects both, and they are often provided by different products.
Do schools have to block the IWF and CTIRU lists?
Yes. The DfE standards say IWF and CTIRU blocklists must be implemented and must not be able to be disabled, overridden or altered by any user, including system administrators. Schools should confirm their provider is an IWF member, is signed up to the CTIRU list and regularly updates its blocklists.
How can a school test its web filter?
The DfE points to testing tools such as the one from SWGfL, and the UK Safer Internet Centre names SWGfL's testfiltering.com. Use it to check that illegal child abuse material, unlawful terrorist content and adult content are blocked, and record the date, who ran the test, what was tested and the actions taken.