DfE Servers and Storage Standards

All servers and storage should continue to work if a single component or service fails

Servers and related storage platforms designed to be secure and resilient will alert you in the event of a service failure, minimising the risk of systems and data being unavailable. To achieve this, several power sources, backup power systems, and a strong remote backup strategy that can switch seamlessly if power fails should be employed. Processes should be in place to replace any failing or failed components and update patches or firmware as quickly as possible. Servers and related storage should be replaced when approaching end of warranty, end of support or end of life. Cloud solutions can lessen the reliance on physical servers and the constant need to update security measures and software.

Your SLT will need to decide the maximum downtime you’re willing to accept. This will be based on the sensitivity and importance of your system and data to the running of your school. Regular reviews of existing servers and related storage platforms should be carried out to ensure they are fully resilient. Valid manufacturer warranties and support agreements should provide a service level that matches how critical your data is. For anything not covered by manufacturer warranties, consider keeping spare components for items most likely to fail.

Servers and storage must be secure and follow data protection legislation

To meet data protection legislation, all IT systems and services must be ‘secure by design’. Protecting sensitive school data from unauthorised access, accidental deletion or malicious attacks is vital. Do this by implementing robust password policies, encryption, and regular security audits, as well as making sure servers and related storage are licensed, updated, and well managed.

Existing systems and services should be reviewed whenever you make a change, or at least each term, to make sure they’re secure. Data Protection Impact Assessments (DPIA) should be carried out for any server or related storage solution that stores personal and or sensitive personal data. If you are storing or processing personal and or sensitive personal data, you will need extra security measures to ensure you meet statutory data protection and GDPR requirements.

All servers and storage should be energy efficient while still meeting requirements

Local servers and their storage platforms run continuously, expending a lot of energy. Minimising energy consumption is a key consideration that translates to cost savings and a positive environmental impact. Schools and colleges are encouraged to adopt an energy efficient approach in terms of server configurations and the implementation of power management strategies.

To ensure your servers and related storage platforms are energy efficient turn off any features that are not used and use power saving settings when inactive. This shouldn’t impact your server performance, prevent backups, or risk damage to the equipment. The servers and related storage you use should be designed to be energy efficient, durable, easy to maintain, repairable, and set up to reduce energy consumption as much as possible. Using cloud-based solutions will increase your overall energy efficiency.

All servers should be kept and used in an appropriate physical environment

Servers and storage units should be housed in appropriate locations that are secure, clean, well-ventilated, and meet specific temperature and humidity requirements, ensuring optimal performance, a longer lifespan, and reduced vulnerabilities to service failure.

Servers and related storage should only be accessible by those who have a genuine need to do so. You can ensure this by putting servers in a dedicated, locked room or cupboard that is not used for any other purpose. This room should meet size requirements set out by the Health and Safety Executive and British Standards. Servers should be mounted or stored in cupboards, be free of flammable items, have a dedicated power supply that can meet or exceed current demand, and have sufficient cooling or mechanically assisted ventilation.

Using cloud-based solutions will reduce the need for local servers. With the DfE recommending you assess where you can replace or reduce your server resources as much as possible, the cloud provides a good option.