Digital safeguarding is part of safeguarding.

Most security problems for a small setting aren't dramatic. They're an account left open after someone left, a password used in three places, or a rushed payment to the wrong bank details. The fixes are just as ordinary — and you can do them in an afternoon.

• 1

  Turn on two-step login (MFA) everywhere that matters

  Email first, then your management software, banking, payroll and cloud storage. It's the single biggest thing you can do, and even if a password leaks, the account stays shut.

• 2

  Use a password manager and a unique password per account

  Let it generate and remember the passwords. For the few you type yourself, three random words make a strong, memorable phrase.

• 3

  Change the default router and Wi-Fi passwords

  Change the router admin password and set a strong Wi-Fi password. Default admin details are often known or easy to find, and Wi-Fi passwords can become widely shared over time.

• 4

  Turn on automatic updates

  Phones, tablets, laptops and apps. Updates quietly fix the weaknesses attackers rely on, so letting them install themselves does the work for you.

• 5

  Separate your devices from your records

  Put cameras, printers and smart gadgets on a guest or device network, away from the computers holding children's and families' information.

• 6

  Back up your key records — and test a restore

  Registers, contracts and safeguarding notes. A backup you've never tested is a guess; restore one file once so you know it works.

• 7

  Use the malware protection you already have

  Built-in protection on modern phones and computers is good — keep it switched on, and don't dismiss its warnings to make something work faster.

• 8

  Give everyone their own login, and remove access when they leave

  Shared logins can't be traced and are hard to switch off safely. Individual accounts mean you can close one the day a person moves on.

• 9

  Agree a money rule and a safe phrase

  Any change to bank details or any urgent payment is checked on a number you already hold. Agree a safe phrase for voice requests, because voices can be faked.

• 10

  Write a one-page “if it goes wrong” plan

  Who's told first, who can lock the accounts, where the backups are, who calls parents, and who decides whether it's a data breach. The incident card on this page is a ready-made template.

You don't have to do all ten today. Each one you tick off makes the nursery a little safer — and the order above puts the highest-value habits first.

For years the advice was to look for the clues: clumsy spelling, odd grammar, a generic greeting. AI has quietly removed those clues. The national cyber authority now warns that AI lets criminals write convincing messages without the spelling and grammar mistakes that used to give phishing away — and that it's getting harder for anyone, however careful, to tell a genuine request from a fake one.

It reaches a nursery through the everyday channels — a WhatsApp message, a voice note, an email that looks like a real supplier. What it tends to look like:

• a “parent” messaging to change the account their fees are paid from
• a “manager” voice note asking a staff member to buy gift cards or move money quickly
• a “supplier” email with new bank details on an otherwise normal-looking invoice
• a message that knows a real detail — a child's name, a recent event — because it was pieced together from public posts

Voice is the newest twist. A short clip of someone speaking — from a voicemail or a social video — can be enough to make a synthetic version of their voice. So a familiar-sounding caller asking you to act fast is no longer proof it's really them.

The constant across every version is urgency. The message needs you to act before you think — a payment that must go today, a code that must be read out now, a problem that's “about to” cost you. That pressure is the scam.

Which is why the defence still works, AI or not: stop, challenge, protect. Pause. It's always fine to say you'll call back. Then verify on a number you already have — from your own records or the organisation's official website, never the number in the message. A real parent, supplier or colleague will understand completely. Only a scam can't survive a five-minute pause.

And to keep this in proportion: the overwhelming majority of messages your nursery gets are genuine. You're not trying to distrust everyone — just to build one cheap habit of checking before money moves or information leaves the building.

It's a natural thought: surely criminals go after big companies with big money. But most attacks aren't aimed at a particular victim at all. They're automated and opportunistic — sweeping for any account with a weak password or any inbox that will click a link. Being small doesn't make you invisible; it often means the basics are assumed to be missing, which makes you easier.

And a nursery holds more of value than it might feel like:

• parents' contact and payment details, kept in one place
• fees and payroll — real money moving in and out on a regular rhythm
• staff email accounts, which families already trust and open
• children's records — information that deserves particular care, and may include health, allergy, safeguarding or family details
• your name and your word, which parents believe when a message comes “from the nursery”

That last one is the quiet prize. A trusted nursery email asking a parent to update payment details will be acted on — that trust is precisely what a criminal is trying to borrow.

Children's data carries an extra duty, too. The Information Commissioner's Office is clear that children's personal data merits specific protection, because children are less aware of the risks. Looking after it well isn't only good practice; for the data you hold on the children in your care, it's expected of you.

This is really the point of the whole pack: digital safeguarding is now part of safeguarding. You already protect the children, families and staff in your building every day. Protecting their information is the same instinct, applied to a few simple online habits — and none of them need you to become technical.