Digital Safety and Educational Continuity Framework
For Schools in High-Risk and Crisis-Affected Regions
Purpose: This framework provides general planning guidance for schools, education networks, and learning communities facing conflict, disasters, public-health emergencies, displacement, severe insecurity, or prolonged service disruption. It is not a substitute for local law, emergency management, child-protection procedures, or professional security advice.
Core principle: Education should remain a safe, inclusive, protective, and voluntary public service. Online learning may support continuity, but it should not be treated as a universal replacement for every learner or as a response to threats through coercion.
This framework is informed by the INEE Minimum Standards, 2024 Edition, which organizes crisis education around participation, coordination, assessment, equitable access, protection and wellbeing, teaching and learning, teacher support, policy, and implementation . It also reflects UNICEF’s view that education in emergencies provides protection, stability, psychosocial support, and long-term resilience , UNESCO’s emphasis on flexible learning pathways and safe, inclusive environments , UNICEF’s online-safety and child-data guidance , UNESCO’s privacy guidance for online learning , and the risk-management orientation of the NIST Cybersecurity Framework 2.0 .
1. Executive Summary
A high-risk school needs more than a remote-learning platform. It needs a continuity system that combines safety assessment, trusted communication, safeguarding, teacher support, inclusive learning modalities, privacy-preserving technology, psychosocial care, records continuity, and a staged recovery plan.
The recommended model is a modality ladder rather than a single technology solution. A school may use live or recorded online classes when safe and accessible, but it should also maintain downloadable materials, offline content, SMS or voice support, radio or television where appropriate, printed packets, telephone check-ins, and safe community-supported arrangements. The system should be designed so that the loss of one channel does not end learning.
The framework has six commitments:
1.Protect people before protecting schedules. Suspend or adapt activities when credible risks cannot be managed.
2.Keep learning available through multiple channels. No learner should be excluded because of bandwidth, device access, disability, language, displacement, or privacy concerns.
3.Protect children and personal data by default. Collect less, expose less, retain less, and explain more.
4.Make decisions participatory and accountable. Learners, families, teachers, school leaders, and relevant authorities should have meaningful roles.
5.Preserve quality, not just contact. Continuity includes instruction, feedback, assessment, wellbeing, and progression.
6.Return safely and deliberately. Recovery should be based on evidence, consultation, and risk review rather than pressure to reopen quickly.
2. Scope, Assumptions, and Boundaries
This framework applies to primary and secondary schools, international schools, language schools, vocational institutions, and education networks. It can be adapted for urban or rural settings, low- or high-connectivity environments, and short disruptions or protracted crises.
It assumes that conditions may change rapidly and that information may be incomplete. It therefore recommends short planning cycles, trusted updates, reversible decisions, and documented assumptions. It does not prescribe tactical security responses, evacuation routes, concealment methods, or counter-violence measures. Those matters belong to qualified local authorities and security professionals.
Framework boundary | Practical implication |
General rather than location-specific | Validate every measure against local law, infrastructure, culture, and risk information. |
Child-centered | Apply safeguarding, consent, accessibility, and best-interest principles to every modality. |
Non-coercive | Recommend voluntary, lawful, and dialogic measures; never use threats to force institutional decisions. |
Technology-aware | Use digital tools where they reduce barriers, but maintain non-digital alternatives. |
Privacy-preserving | Do not publish student lists, exact staff locations, access credentials, or sensitive facility details. |
3. Governance and Accountability
The school should establish a small Continuity and Safety Group with authority to coordinate education, safeguarding, technology, communications, inclusion, wellbeing, and recovery. The group should include school leadership, a safeguarding lead, an IT or digital-safety lead, a teacher representative, a family or community representative, an accessibility representative, and a student voice mechanism appropriate to age and safety.
Decision rights should be explicit. The school board or authorized education authority approves policy; school leadership activates continuity arrangements; the safeguarding lead manages protection concerns; the digital-safety lead manages accounts and incidents; teachers adapt learning; families and learners provide feedback; and external partners support rather than replace accountable school leadership.
Role | Core responsibility | Minimum accountability practice |
School leadership | Authorize activation, communicate decisions, allocate resources | Maintain a dated decision log and review assumptions weekly during disruption |
Safeguarding lead | Manage disclosures, referrals, and protection pathways | Maintain confidential case procedures and safe referral contacts |
Digital-safety lead | Secure systems, accounts, devices, backups, and incident response | Review access logs, update controls, and document incidents without unnecessary personal data |
Teachers | Deliver learning, check wellbeing, provide feedback | Use approved channels and report safeguarding or access concerns |
Families and learners | Provide consent, feedback, and practical information | Use official channels and avoid forwarding sensitive information |
Accessibility lead | Check usability for disability, language, and assistive technology needs | Test representative materials and document remediation |
External partners | Provide technical, humanitarian, psychosocial, or education support | Use written data-sharing and accountability agreements |
4. Risk-Informed Planning
The school should maintain a high-level risk register that considers both physical and digital threats. The goal is not to forecast every event, but to identify preventable harm, dependencies, warning signs, and safe responses.
Risk domain | Examples | Preventive controls | Continuity response |
Physical safety | Violence, hazardous travel, damaged facilities, displacement | Local risk assessment, safe communication, flexible attendance, coordination with authorities | Pause or adapt activities, activate alternative modalities, provide trusted updates |
Digital intrusion | Phishing, account takeover, malware, impersonation | MFA, least privilege, patching, backups, verified domains, staff training | Isolate affected accounts, revoke sessions, preserve evidence, notify appropriate parties |
Privacy and surveillance | Unnecessary data collection, location exposure, unsafe recordings | Data minimization, retention limits, privacy settings, consent, encryption | Stop collection, restrict access, assess exposure, support affected people |
Safeguarding | Grooming, harassment, abuse, harmful content, unsafe contact | Moderation, reporting, adult accountability, age-appropriate design | Follow confidential referral and child-protection procedures |
Exclusion | No device, weak network, disability, language barrier, shared household device | Modality ladder, accessible formats, offline packs, translated guidance | Target support without publishing sensitive learner data |
Wellbeing | Trauma, isolation, stress, burnout, grief | Predictable routines, psychosocial support, staff care, referral pathways | Reduce workload, provide check-ins, connect to qualified services |
Information disorder | Rumors, impersonation, hate speech, panic | Single official channels, message verification, media literacy | Correct calmly, preserve evidence, avoid amplifying unverified claims |
Service failure | Power outage, platform outage, telecom disruption | Redundant channels, local copies, printed materials, tested recovery | Switch to fallback modality and communicate the change |
Use a simple rating such as likelihood, impact, vulnerability, and preparedness. Do not publish the full risk register if it exposes sensitive information; maintain a public summary and a restricted operational version.
5. Continuity Architecture and Modality Ladder
Continuity should be designed as a sequence of supported modalities, each with clear learning objectives and a way to move between channels.
Tier 1: Connected online learning
Use a managed learning platform, live classes, recorded lessons, digital assignments, and teacher feedback when learners can connect safely. Require captions or transcripts where feasible, accessible documents, clear schedules, and a channel for safeguarding concerns that is separate from ordinary class chat.
Tier 2: Low-bandwidth and mobile learning
Provide compressed files, text-first lessons, asynchronous discussion, SMS reminders, voice notes, and telephone support. Design materials to work on older devices and shared phones. Avoid requiring continuous video participation as proof of engagement.
Tier 3: Offline digital learning
Offer downloadable lessons, USB or memory-card content where safe and lawful, local-network resources, device-based quizzes, and printed instructions for synchronization. Use clear version numbers so learners know which materials are current.
Tier 4: Broadcast and voice learning
Where appropriate, use radio, television, recorded phone lessons, call-in support, or scheduled voice sessions. Broadcast content should be paired with accessible worksheets and a method for feedback, not treated as one-way communication only.
Tier 5: Printed and supported learning
Provide printed packets, textbooks, teacher phone hours, and safe collection or delivery arrangements. Avoid requiring learners to travel to a school facility when risk information indicates that travel is unsafe. Use trusted partners for distribution only under clear safeguarding and privacy rules.
Tier 6: Safe community learning
Where permitted and safe, use small, accessible learning arrangements supported by trained adults and community partners. Locations, schedules, and participant information should not be publicly posted if doing so could create risk.
Modality | Best use | Minimum safeguard |
Live online | Discussion, demonstrations, pastoral connection | Waiting rooms or controlled access, consent, moderation, recording off by default |
Recorded lesson | Flexible access and review | Captions, download controls where appropriate, clear retention policy |
SMS or voice | Reminders, check-ins, low-bandwidth support | Verified sender identity and discreet wording |
Radio or television | Broad reach during connectivity disruption | Accessible scripts, companion materials, feedback route |
Printed pack | No-device or no-network access | Safe distribution, version control, teacher feedback |
Community learning | Structured support and social connection | Local safeguarding assessment and trained supervision |
6. Digital-Safety Baseline
The school should adopt a risk-based baseline aligned with the Govern, Identify, Protect, Detect, Respond, and Recover logic commonly used in cybersecurity risk management . Controls should be proportionate to the school’s capacity and reviewed after every significant incident.
Identity and access
Use individual accounts wherever feasible. Require multi-factor authentication for administrators, teachers, and staff with access to sensitive records. Apply least privilege, separate administrative and teaching accounts, disable inactive accounts promptly, review access each term, and provide a safe process for lost devices or suspected compromise.
Devices and networks
Enable automatic security updates where practical, use screen locks, encrypt supported devices, separate guest and administrative networks, and avoid storing sensitive learner records on unmanaged personal devices. For shared devices, use separate profiles and clear logout procedures. Maintain an inventory without collecting more personal information than necessary.
Data protection
Before collecting data, ask whether it is essential, who needs it, how long it will be retained, and what harm could result from exposure. Avoid publishing student names with photographs, precise locations, schedules, or contact details without a legitimate, documented reason and appropriate consent. Use encryption in transit and at rest where feasible, restrict exports, and maintain a deletion schedule.
Platforms and vendors
Approve platforms through a documented review covering privacy, age appropriateness, accessibility, moderation, data location, breach notification, account recovery, offline access, and exit options. Do not allow a vendor to use student data for unrelated advertising or profiling. Ensure the school can export learning records in a usable format if a platform becomes unavailable.
Communication security
Maintain a small list of official domains, phone numbers, and channels. Tell families how to verify messages. Use message templates for urgent announcements, but avoid including sensitive details in mass messages. A school should never ask families to send passwords, identity documents, or precise live locations through unverified channels.
Incident response
Define a calm, non-punitive reporting route. When a digital incident occurs, the school should contain the issue, protect people first, preserve essential evidence, communicate only confirmed information, restore services safely, and conduct a lessons-learned review. Do not investigate suspected abuse through informal questioning of children or by asking them to forward harmful material unnecessarily.
7. Safeguarding and Child Protection
Every online or hybrid programme should have a safeguarding policy that applies equally to digital and physical settings. Learners should know how to report bullying, grooming, harassment, inappropriate contact, harmful content, or coercion. Teachers should know how to receive a disclosure without promising secrecy, record only what is necessary, and refer through approved procedures.
For minors, avoid open contact between unknown adults and learners. Use moderated channels, approved staff accounts, age-appropriate interaction, and clear rules for one-to-one communication. Record lessons only when necessary, with a defined purpose, access restriction, retention period, and notice to participants.
Safeguarding information should be accessible in the languages used by families. Students with disabilities may need alternative reporting channels, including captioned video, text, audio, symbol-supported communication, or a trusted adult who is not the alleged source of harm.
8. Inclusive Learning and Accessibility
The school should test each continuity pathway with representative learners before activation. A digital lesson is not accessible merely because it is online. Check keyboard access, captions, transcript quality, color contrast, readable documents, screen-reader structure, language support, file size, and compatibility with assistive technologies.
Provide reasonable alternatives for learners who cannot safely appear on camera, share a room with others, use a personal device, travel to collect materials, or participate at a fixed time. Do not punish a learner for a connectivity or safety barrier that the programme failed to accommodate.
9. Teacher Support and Instructional Quality
Teachers need training in emergency pedagogy, platform security, safeguarding, accessible content, low-bandwidth design, psychosocially supportive communication, and assessment integrity. They also need manageable workloads and protected time for preparation and pastoral contact.
Use short learning cycles: clear objective, brief content, supported practice, feedback, and a low-burden check for understanding. Where live classes are used, record a transcript or provide an equivalent alternative when safe. Avoid turning emergency education into a surveillance system based on constant camera presence or continuous screen monitoring.
10. Psychosocial Support and Wellbeing
Education can provide structure and connection, but teachers are not a substitute for qualified mental-health professionals. Establish referral pathways, provide age-appropriate wellbeing activities, maintain predictable routines, and allow learners to opt out of public sharing. Staff wellbeing should include workload limits, peer support, supervision, and access to professional services where available.
Communication should avoid graphic descriptions, rumors, and unnecessary repetition of distressing events. When an incident affects the school community, provide a short factual message, explain support options, and identify where verified updates will appear.
11. Activation, Continuity, and Recovery Phases
Phase | Main objective | Key actions |
Preparedness | Build capacity before disruption | Map modalities, train staff, test backups, approve vendors, prepare accessible materials, verify contact trees |
Activation | Make a safe decision quickly | Convene authorized group, assess current risk, communicate what is known, choose the least disruptive safe modality |
Stabilization | Keep learning and protection functioning | Run the modality ladder, monitor access, support teachers, manage incidents, update families |
Adaptation | Improve the response | Review participation, equity, wellbeing, safeguarding, outages, and teacher workload; adjust delivery |
Recovery | Restore or redesign services | Assess facilities and risk, consult communities, phase return or continue hybrid options, protect records |
After-action review | Learn and prepare again | Document what worked, what failed, unresolved risks, and resource requirements without exposing sensitive details |
Activation should not be based on a single rumor or social-media post. Use multiple trusted sources, document the decision basis, and provide a review time. If information is uncertain, communicate the uncertainty instead of presenting speculation as fact.
12. Communications Plan
A safe public message should contain five parts: what is known; what the school is doing; what families and learners can do; where verified updates will appear; and how to ask for help or report a concern.
Illustrative message:
“To protect learning and wellbeing during the current disruption, the school is offering voluntary online, offline, telephone, and printed learning options. Families may choose the channel that is safest and most accessible for them. No learner will be penalized for a connectivity, disability, displacement, or safety barrier. Verified updates will be posted through the school’s official channels. For safeguarding or urgent support, use the confidential contact listed in the family information pack.”
Do not state that a school will be attacked, name alleged perpetrators, or pressure an institution to close or change service delivery through fear. If a credible threat is reported, refer it to competent authorities and qualified safeguarding or security personnel rather than turning it into public campaign content.
13. Monitoring and Evaluation
Monitor both learning and safety. Avoid collecting detailed personal data merely because it is easy to measure. Use aggregate reporting wherever possible.
Indicator | Example measure | Equity and privacy check |
Reach | Percentage of learners receiving at least one learning contact | Disaggregate only when safe; examine device, language, disability, and displacement barriers |
Participation | Assignment or lesson engagement by modality | Do not equate camera use with learning |
Learning | Formative checks and teacher feedback completion | Offer accessible and offline assessment routes |
Continuity | Time required to switch to a fallback modality | Test whether the fallback actually works for low-connectivity users |
Safety | Safeguarding reports, response time, and referral completion | Protect case confidentiality and avoid public counts that identify individuals |
Digital security | MFA coverage, patching, incident closure, backup restoration tests | Report trends, not sensitive technical weaknesses |
Wellbeing | Voluntary check-ins and referral access | Do not force disclosure or diagnose learners |
Teacher sustainability | Workload, training completion, and support requests | Adjust schedules and staffing before burnout becomes a failure point |
14. Resource and Budget Categories
Budgeting should include more than platform licenses. Plan for devices and charging, connectivity support, printed materials, translation, captions, accessibility, teacher training, safeguarding personnel, psychosocial services, technical support, secure backups, incident response, platform exit, and monitoring.
A resilient programme may be more expensive than a single-platform programme at the start, but redundancy reduces dependence on one network, vendor, or physical site. Resource decisions should be transparent and prioritize learners facing the greatest barriers.
15. Review Checklist
Before activation, confirm that the school has:
•A documented, authorized decision process.
•At least three learning modalities, including one low- or no-connectivity option.
•A verified family communication channel and an impersonation-warning process.
•Safeguarding reporting and referral procedures.
•MFA for administrators and staff with sensitive access.
•A data inventory, retention plan, and vendor review.
•Accessible and multilingual materials.
•Teacher training and workload protections.
•Psychosocial and disability-support pathways.
•Tested backups and an exit plan for the learning platform.
•A monitoring plan that does not turn surveillance into the definition of participation.
•A recovery and after-action review schedule.
16. Limitations and Local Adaptation
This framework cannot determine whether a particular school should open, close, relocate, or move online. Those decisions depend on local facts, competent authorities, school leadership, family consultation, safeguarding conditions, and professional risk assessment. Digital learning can protect continuity, but it can also increase exposure to privacy loss, harassment, exclusion, and misinformation if introduced without safeguards.
The correct objective is not to maximize technology. It is to preserve safe, equitable, meaningful learning through multiple channels while protecting the dignity and agency of learners, educators, and families.
References
PEACE.
No comments:
Post a Comment